CVE-2025-2866

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2866
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.libreoffice.org/about-us/security/advisories/cve-2025-2866 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:24.8.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:24.8.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:25.2.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:25.2.0.0:beta1:*:*:*:*:*:*
History

12 May 2025, 19:05

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
First Time Libreoffice
Libreoffice libreoffice
References () https://www.libreoffice.org/about-us/security/advisories/cve-2025-2866 - () https://www.libreoffice.org/about-us/security/advisories/cve-2025-2866 - Vendor Advisory
CPE cpe:2.3:a:libreoffice:libreoffice:24.8.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:25.2.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:24.8.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:25.2.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*

29 Apr 2025, 13:52

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de verificación incorrecta de firma criptográfica en LibreOffice permite la suplantación de firmas PDF mediante una validación incorrecta. En las versiones afectadas de LibreOffice, una falla en el código de verificación de firmas adbe.pkcs7.sha1 podría provocar que firmas no válidas se acepten como válidas. Este problema afecta a LibreOffice: desde la versión 24.8 hasta la 24.8.6, desde la versión 25.2 hasta la 25.2.2.

27 Apr 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-27 19:15

Updated : 2025-05-12 19:05

NVD link : CVE-2025-2866

Mitre link : CVE-2025-2866

CVE.ORG link : CVE-2025-2866

JSON object : View

Products Affected

libreoffice

  • libreoffice
CWE
CWE-347

Improper Verification of Cryptographic Signature