CVE-2021-25631 - CVE House
Back to Database
Status published High CVE-2021-25631

denylist of executable filename extensions possible to bypass under windows

Vulnerability Description

In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an executable type.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-25631

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Lukas Euler of Positive Security

References

More from The Document Foundation

View All →
CVE-2025-2866
PDF signature forgery with adbe.pkcs7.sha1 SubFilter
Low 2.4
CVE-2025-1080
Macro URL arbitrary script execution
High 7.2
CVE-2025-14714
TCC Bypass via Inherited Permissions in Bundled Interpreter
Low 0.9
CVE-2025-0514
Executable hyperlink Windows path targets executed unconditionally on activation
High 7.2
CVE-2024-7788
Signatures in "repair mode" should not be trusted
High 7.8

Affected Vendor

The Document Foundation

View all reports →

Affected Software

LibreOffice
Vulnerable Versions:
7.1, 7.0

Timeline

Official Publish: May 3rd, 2021
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-184

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.