Vulnerability details

CVE-2025-64405

Apache Software Foundation Apache OpenOffice

Apache OpenOffice: Remote documents loaded without prompt via DDE function

CVSS 3.1

7.5High

Official description

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to external files would load the contents of those files without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
Apache Software Foundation	Apache OpenOffice	v ≤ 4.1.15	CVEProject cvelistV5 (CNA)

References and advisories

https://www.openoffice.org/security/cves/CVE-2025-64405.html vendor-advisory
https://lists.apache.org/thread/0jjftxkcc4l9kt7jjn630hfrh2ygfcbk vendor-advisory
http://www.openwall.com/lists/oss-security/2025/11/11/8

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-11-12
Last updated: 2025-11-13
State: Published
Assigner (CNA): apache

Exploit prediction (EPSS)

1.44%

Probability of exploitation in 30 days

73.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-862
Missing Authorization