CVE-2024-12425

What it actually does

Improper pathname limitation allowing absolute path traversal that permits writing files to arbitrary locations when the written path is suffixed with .ttf, via documents containing embedded font data.

Why it matters to the business

Potential for system file overwrites or placement of malicious content that could lead to application instability, data corruption, or follow-on compromise, though current exploit likelihood remains low.

How an attack unfolds

An attacker prepares a document in a format supporting embedded fonts, embeds a font reference using an absolute path ending in .ttf, and delivers the file to a target running an affected LibreOffice version; opening the document triggers the write to the attacker-chosen location.

How to fix it

Upgrade LibreOffice 24.8 series to version 24.8.4 or newer; apply vendor patches as they become available for other branches and verify installation after update.

How to confirm the fix worked

Confirm installed LibreOffice version is 24.8.4 or later; attempt to open a test document referencing a controlled .ttf path and verify writes are confined to expected directories.

Typical attack path

1. Create document containing embedded font with absolute destination path ending in .ttf
2. Distribute document via email, download, or shared storage
3. Victim opens document in vulnerable LibreOffice release
4. Arbitrary file write occurs on the target system

How to detect it

Review system and application logs for document open events followed by unexpected file writes ending in .ttf; inspect directories for newly created font files outside standard font paths.

What your security team should do

• Prioritize upgrade of all LibreOffice 24.8 installations to 24.8.4 or later
• Restrict opening of untrusted documents from external sources until patched
• Monitor file-creation events for unexpected .ttf files outside font directories