CVE-2025-1080 - CVE House
Back to Database
Status published High CVE-2025-1080

Macro URL arbitrary script execution

Vulnerability Description

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-1080

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Thanks to Amel Bouziane-Leblond for finding and reporting this issue.

References

More from The Document Foundation

View All →
CVE-2025-2866
PDF signature forgery with adbe.pkcs7.sha1 SubFilter
Low 2.4
CVE-2025-14714
TCC Bypass via Inherited Permissions in Bundled Interpreter
Low 0.9
CVE-2025-0514
Executable hyperlink Windows path targets executed unconditionally on activation
High 7.2
CVE-2024-7788
Signatures in "repair mode" should not be trusted
High 7.8
CVE-2024-6472
Ability to trust not validated macro signatures removed in high security mode
High 7.8

Affected Vendor

The Document Foundation

View all reports →

Affected Software

LibreOffice
Vulnerable Versions:
24.8, 25.2

Timeline

Official Publish: March 4th, 2025
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact