CVE-2025-64403

HighCVSS 8.1/10Last modified Oct 18, 2026

Description

Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause such links to be loaded without prompt.

This issue affects Apache OpenOffice: through 4.1.15.

Users are recommended to upgrade to version 4.1.16, which fixes the issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache OpenOffice	<= 4.1.15

References

https://lists.apache.org/thread/t7c6jhvdb00xtgd9vvn7h5sq9f4h5trtMailing List, Vendor Advisory
https://www.openoffice.org/security/cves/CVE-2025-64403.htmlVendor Advisory
http://www.openwall.com/lists/oss-security/2025/11/11/6Mailing List, Third Party Advisory

Timeline

Published: Nov 12, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-644047.5Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker CVE-2025-644057.5Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a doc CVE-2025-644064.3An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or other CVE-2025-644075.3Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a doc CVE-2025-644086.3Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. CVE-2025-64419.8The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vul CVE-2025-644198.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, paramet CVE-2025-64425.9Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests CVE-2025-644208.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and includi CVE-2025-644218.0Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including CVE-2025-644224.3Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-CVE-2025-644238.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including