CVE-2025-1080: Macro URL arbitrary script execution

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-04 · updated 2026-06-17
Weakness: CWE-20

Description

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.

Affected products

Debian Linux: 11.0
The Document Foundation LibreOffice: from 24.8.0.0 before 24.8.5.1; from 25.2.0.0 before 25.2.1.1 — fixed in 24.8.5.1, 25.2.1.1

How to fix

Upgrade to a fixed version: The Document Foundation LibreOffice 24.8.5.1, 25.2.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-1080 or the next vulnerability affects your stack