What’s Vulnerable › Vulnerabilities

CVE-2025-64405: Apache OpenOffice: Remote documents loaded without prompt via DDE function

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-12 · updated 2026-10-18
• Weakness: CWE-862

Description

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to external files would load the contents of those files without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue.

Affected products

• Apache Software Foundation Apache OpenOffice: before 4.1.16 — fixed in 4.1.16

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache OpenOffice 4.1.16. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/0jjftxkcc4l9kt7jjn630hfrh2ygfcbk
• https://www.openoffice.org/security/cves/CVE-2025-64405.html
• http://www.openwall.com/lists/oss-security/2025/11/11/8

Get alerted when CVE-2025-64405 or the next vulnerability affects your stack