CVE-2022-26305

What it actually does

The vulnerability allows an attacker to bypass macro signature validation by forging a certificate that matches only the serial number and issuer of a trusted certificate, causing LibreOffice to treat the macro as signed by a trusted author without verifying the actual cryptographic signature.

Why it matters to the business

Organizations using affected LibreOffice versions face increased risk of users inadvertently executing malicious macros in documents, potentially leading to unauthorized code execution, data compromise, or system compromise; the issue affects a widely deployed productivity suite with high ecosystem prevalence.

How an attack unfolds

An attacker crafts a malicious macro, generates a certificate with identical serial number and issuer to a known trusted certificate, signs the macro with the forged certificate, and distributes the document; when the user opens it, LibreOffice incorrectly validates the signature and prompts the user to enable the macro, resulting in arbitrary code execution.

How to fix it

Upgrade LibreOffice 7.2 installations to version 7.2.7 or later and 7.3 installations to version 7.3.1 or later; enable macro security settings to require explicit user approval and consider disabling macros from untrusted sources.

How to confirm the fix worked

Verify installed LibreOffice version is at least 7.2.7 or 7.3.1; test macro signature validation behavior with known trusted and forged certificates to confirm proper cryptographic checks occur.

Typical attack path

1. Identify or obtain a trusted certificate's serial number and issuer details
2. Generate a matching but attacker-controlled certificate
3. Create a document containing a malicious macro and sign it with the forged certificate
4. Distribute the document to the target
5. Trick the user into opening the document and enabling macros
6. Execute arbitrary code on the victim's system

How to detect it

Examine document metadata and macro signature logs for certificates whose serial and issuer match trusted entries but lack valid cryptographic binding; review user activity logs for unexpected macro-enabled documents from external sources.

What your security team should do

• Prioritize upgrading all LibreOffice instances to fixed versions immediately due to the 1535 days since publication and rising EPSS trend
• Review and harden macro security policies across the organization
• Educate users on risks of enabling macros from untrusted documents
• Monitor for any new exploit maturity indicators or threat actor activity targeting this weakness