CVE-2021-25631 json
denylist of executable filename extensions possible to bypass under windows
published 2021-05-03 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-12527
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.0%
- EPSS 5.0% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an executable type.
Patch / fix
- The Document Foundation LibreOffice 7.0.5, 7.1.2
- libreoffice Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 7.2.2.2-r0
alpine advisories ALPINE-CVE-2021-25631
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Exploit prediction
5.04% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- positive.security https://positive.security/blog/url-open-rce#open-libreoffice referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- The Document Foundation LibreOffice
Classification
- Weakness
-
- CWE-184 Incomplete List of Disallowed Inputs
References
-
positive.security
/blog/url-open-rce#open-libreoffice
exploit, third-party-advisory
-
libreoffice.org
/about-us/security/advisories/cve-2021-25631/
vendor-advisory
Sources
- CVE List CVE-2021-25631
- NVD CVE-2021-25631
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.