CVE-2025-0514

What it actually does

The vulnerability stems from missing validation on hyperlink targets in LibreOffice documents, permitting direct execution of Windows executable files upon user activation without any sandboxing or confirmation.

Why it matters to the business

Organizations using affected LibreOffice versions face elevated risk of malware execution through everyday documents, potentially leading to data breaches or system compromise, though low exploit prevalence and absence from known ransomware campaigns reduce immediate urgency.

How an attack unfolds

An attacker creates a specially crafted document containing a hyperlink pointing to a Windows executable hosted locally or remotely; when the recipient opens the document and activates the link, the executable runs without further checks.

How to fix it

Upgrade LibreOffice to version 24.8.5 or later; for libreoffice/core apply commit 8e3f91296d65a47712b8a390b4731fa5a2f6c9af; apply available Ubuntu package updates for qemu if present in the environment.

How to confirm the fix worked

Verify installed LibreOffice version is at least 24.8.5; test hyperlink behavior in a controlled document to confirm execution is now blocked or prompted; review package manifests for the listed fixed commits.

Typical attack path

1. Craft a LibreOffice document embedding a hyperlink targeting a Windows executable
2. Deliver the document via email, shared storage, or download
3. Victim opens the document in an affected LibreOffice version
4. Victim activates the hyperlink, triggering unconditional execution of the target executable

How to detect it

Review document application logs and system process creation events for unexpected executable launches triggered immediately after opening LibreOffice files; correlate with file access timestamps on potentially malicious documents.

What your security team should do

• Prioritize patching LibreOffice installations to 24.8.5+ across the enterprise
• Disable or restrict hyperlink execution features where possible until patches are applied
• Monitor for unusual process launches originating from document applications
• Educate users on risks of activating hyperlinks in untrusted documents