The Apache OpenOffice Security Team has disclosed seven critical security vulnerabilities in its latest security bulletin, affecting users of the popular open-source office productivity suite.
These flaws, addressed in Apache OpenOffice 4.1.16, pose significant risks, including memory corruption and unauthorized loading of remote content that could compromise user data and system integrity.
The vulnerabilities primarily involve unauthorized loading of remote documents through various attack vectors.
Five of the discovered flaws enable malicious actors to load remote documents without user consent through different mechanisms, including IFrames, OLE objects, external data sources in Calc spreadsheets, background and bullet images, and Dynamic Data Exchange functions.
These security gaps could allow attackers to execute phishing campaigns or deliver malicious payloads to unsuspecting users.
Two particularly severe vulnerabilities demand immediate attention. CVE-2025-64406 addresses possible memory corruption during CSV file imports, which could potentially allow attackers to execute arbitrary code by crafting malicious CSV files.
Additionally, CVE-2025-64407 reveals that URL fetching mechanisms can be exploited to exfiltrate sensitive information, including arbitrary INI file values and environment variables, potentially exposing confidential system configurations and user credentials.
The Apache OpenOffice Security Team strongly recommends all users upgrade to version 4.1.16 immediately to protect against these vulnerabilities.
Organizations relying on Apache OpenOffice for document processing should prioritize this update, especially those handling sensitive information or operating in regulated industries.
Users should exercise caution when opening documents from untrusted sources and verify file authenticity before processing.
This security release follows Apache OpenOffice’s ongoing commitment to maintaining software security.
The previous version 4.1.15 addressed four vulnerabilities, including arbitrary file-write issues and macro-based URL script execution flaws.
The consistent identification and remediation of security issues highlights the importance of regular software updates and vigilant security practices in enterprise environments.
Vulnerability Details
| CVE ID | Vulnerability | Severity |
|---|---|---|
| CVE-2025-64401 | Remote documents loaded without prompt via IFrame | High |
| CVE-2025-64402 | Remote documents loaded without prompt via OLE objects | High |
| CVE-2025-64403 | Remote documents loaded without prompt via external data sources in Calc | High |
| CVE-2025-64404 | Remote documents loaded without prompt via background and bullet images | High |
| CVE-2025-64405 | Remote documents loaded without prompt via DDE function | High |
| CVE-2025-64406 | Possible memory corruption during CSV import | Critical |
| CVE-2025-64407 | URL fetching can exfiltrate arbitrary INI file values and environment variables | Critical |
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1068,580&ssl=1&description=These flaws, addressed in Apache OpenOffice 4.1.16, pose significant risks, including memory corruption and unauthorized loading){kind=link}