CVE-2024-3044: Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will…

PriorityP335medium6.5CVSS 3.1

AVNACLPRNUINSUCNILAL

EPSS

1.01%

58.7th percentile

Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	libreoffice	< libreoffice 4:7.4.7-1+deb12u2 (bookworm)	libreoffice 4:7.4.7-1+deb12u2 (bookworm)
fedoraproject	fedora	—	—
libreoffice	libreoffice	< 7.6.7.1	7.6.7.1
libreoffice	libreoffice	>= 0 < 1:7.0.4-4+deb11u9	1:7.0.4-4+deb11u9
libreoffice	libreoffice	>= 0 < 4:7.4.7-1+deb12u2	4:7.4.7-1+deb12u2
libreoffice	libreoffice	>= 0 < 4:24.2.3~rc1-2	4:24.2.3~rc1-2
libreoffice	libreoffice	>= 0 < 4:24.2.3~rc1-2	4:24.2.3~rc1-2
libreoffice	libreoffice	>= 24.2.0.0 < 24.2.3.1	24.2.3.1
the_document_foundation	libreoffice	>= 24.2 < 24.2.3	24.2.3
the_document_foundation	libreoffice	>= 7.6 < 7.6.7	7.6.7

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

osv6.5MEDIUM

vendor_debian6.5MEDIUM

vendor_redhat6.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.