LibreOffice Macro URL Arbitrary Script Execution Vulnerability

A vulnerability exists in LibreOffice versions 24.8 prior to 24.8.5 and 25.2 prior to 25.2.1, allowing for arbitrary script execution via internal macros. This is achieved by constructing a link in a browser using the 'vnd.libreoffice.command' scheme, which can embed a URL that, when opened in LibreOffice, executes macros with specified arguments. This issue arises from the integration of LibreOffice with MS SharePoint, where the additional URI scheme could be exploited to bypass normal macro execution controls.

Impact

Exploitation of this vulnerability allows for arbitrary execution of macros in LibreOffice, potentially leading to unauthorized actions or changes within the application, depending on the nature of the executed macros.

Remediation

Users are advised to upgrade to LibreOffice versions 24.8.5 or 25.2.1.