What’s Vulnerable › Vulnerabilities

CVE-2024-3044: Graphic on-click binding allows unchecked script execution

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-14 · updated 2026-06-17
• Weakness: CWE-356

Description

Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.

Affected products

• Debian Linux: 10.0
• Fedoraproject Fedora: 39
• The Document Foundation LibreOffice: before 7.6.7.1; from 24.2.0.0 before 24.2.3.1 — fixed in 24.2.3.1, 7.6.7.1

How to fix

Upgrade to a fixed version: The Document Foundation LibreOffice 24.2.3.1, 7.6.7.1. Check the vendor advisory for mitigations.

References

• https://lists.debian.org/debian-lts-announce/2024/05/msg00016.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TU3TYDXICKPYHMCNL7ARYYBXACEAYJ4/
• https://www.libreoffice.org/about-us/security/advisories/CVE-2024-3044
• https://lists.debian.org/debian-lts-announce/2024/05/msg00016.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TU3TYDXICKPYHMCNL7ARYYBXACEAYJ4/
• https://www.libreoffice.org/about-us/security/advisories/CVE-2024-3044

Get alerted when CVE-2024-3044 or the next vulnerability affects your stack