CVE-2024-12426

What it actually does

Specially crafted URLs in documents expand environment variables and arbitrary INI file values, allowing sensitive data to be sent to a remote server when the document is opened.

Why it matters to the business

Attackers can obtain private configuration and environment details from users who open malicious documents, increasing risk of further targeted attacks or credential exposure.

How an attack unfolds

An attacker embeds URLs referencing environment variables or INI values inside a document; when a victim opens the file in an affected LibreOffice version the values are expanded and the resulting request exfiltrates the data to an attacker-controlled server.

How to fix it

Upgrade LibreOffice to version 24.8.4 or later; disable automatic expansion of environment variables in document links if a configuration option exists.

How to confirm the fix worked

Confirm LibreOffice reports version 24.8.4 or higher; attempt to open a test document containing an environment-variable URL and verify the variable is no longer expanded in the resulting network request.

Typical attack path

1. Create a document containing malicious URLs that reference %ENV% variables or INI keys
2. Host or deliver the document via email, shared drive or web link
3. Victim opens the document in LibreOffice 24.8.x
4. LibreOffice expands the references and performs an outbound request containing the sensitive values

How to detect it

Review network logs for unexpected outbound connections initiated by LibreOffice shortly after document open events; inspect proxy or firewall logs for URLs containing expanded environment-variable patterns.

What your security team should do

• Prioritize patching all LibreOffice 24.8 installations to 24.8.4 within the next 30 days
• Block or monitor outbound traffic from LibreOffice processes to untrusted destinations
• Add user awareness guidance about opening documents from unknown sources