high 7.5

CVE-2022-26306 json

Execution of Untrusted Macros Due to Improper Certificate Validation

published 2022-07-25 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-30867

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.

Patch / fix

fixed in 1 distros 7

The Document Foundation LibreOffice 7.2.7, 7.3.1

debian ubuntu red hat almalinux rocky linux alpine arch linux

libreoffice Debian 14, Debian 13, Debian 12 1:7.3.3~rc1-2

debian advisories DEBIAN-CVE-2022-26306

libreoffice Ubuntu 18.04 LTS 1:6.0.7-0ubuntu0.18.04.12
libreoffice Ubuntu 20.04 LTS 1:6.4.7-0ubuntu0.20.04.5

ubuntu advisories UBUNTU-CVE-2022-26306

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

libreoffice RHEL 9 1:7.1.8.1-8.el9_1
autocorr-af RHEL 9 1:7.1.8.1-8.el9_1
autocorr-bg RHEL 9 1:7.1.8.1-8.el9_1
autocorr-ca RHEL 9 1:7.1.8.1-8.el9_1
autocorr-cs RHEL 9 1:7.1.8.1-8.el9_1
autocorr-da RHEL 9 1:7.1.8.1-8.el9_1
autocorr-de RHEL 9 1:7.1.8.1-8.el9_1
autocorr-el RHEL 9 1:7.1.8.1-8.el9_1

red hat advisories RHSA-2023:0304 RHSA-2023:0089

autocorr-af AlmaLinux 9 1:7.1.8.1-8.el9_1.alma
autocorr-bg AlmaLinux 9 1:7.1.8.1-8.el9_1.alma
autocorr-ca AlmaLinux 9 1:7.1.8.1-8.el9_1.alma
autocorr-cs AlmaLinux 9 1:7.1.8.1-8.el9_1.alma
autocorr-da AlmaLinux 9 1:7.1.8.1-8.el9_1.alma
autocorr-de AlmaLinux 9 1:7.1.8.1-8.el9_1.alma
autocorr-el AlmaLinux 9 1:7.1.8.1-8.el9_1.alma
autocorr-en AlmaLinux 9 1:7.1.8.1-8.el9_1.alma

almalinux advisories ALSA-2023:0304 ALSA-2023:0089

libreoffice Rocky Linux 9 1:7.1.8.1-8.el9_1
libreoffice Rocky Linux 8 1:6.4.7.2-12.el8_7

rocky linux advisories RLSA-2023:0304 RLSA-2023:0089

libreoffice Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 7.2.7.2-r0

alpine advisories ALPINE-CVE-2022-26306

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

libreoffice-fresh Arch Linux 7.3.3-1
libreoffice-still Arch Linux 7.2.7-1

arch linux advisories AVG-2783 AVG-2784

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-26306 updated 2026-11-07 cvss 7.5

libreoffice: Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password

Red Hat Enterprise Linux 8 autocorr-af, autocorr-bg, autocorr-ca, autocorr-cs, autocorr-da, autocorr-de, +98 more
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux 9 autocorr-af, autocorr-bg, autocorr-ca, autocorr-cs, autocorr-da, autocorr-de, +101 more
affected: no fix available
Red Hat CodeReady Linux Builder (v. 8) libreoffice-sdk 6.4.7.2-12.el8_7
fixed: vendor fix RHSA-2023:0089
Red Hat CodeReady Linux Builder (v. 9) libreoffice-sdk 7.1.8.1-8.el9_1
fixed: vendor fix RHSA-2023:0304
Red Hat Enterprise Linux AppStream (v. 8) autocorr-af 6.4.7.2-12.el8_7, autocorr-bg 6.4.7.2-12.el8_7, autocorr-ca 6.4.7.2-12.el8_7, autocorr-cs 6.4.7.2-12.el8_7, autocorr-da 6.4.7.2-12.el8_7, autocorr-de 6.4.7.2-12.el8_7, +95 more
fixed: vendor fix RHSA-2023:0089
Red Hat Enterprise Linux AppStream (v. 9) autocorr-af 7.1.8.1-8.el9_1, autocorr-bg 7.1.8.1-8.el9_1, autocorr-ca 7.1.8.1-8.el9_1, autocorr-cs 7.1.8.1-8.el9_1, autocorr-da 7.1.8.1-8.el9_1, autocorr-de 7.1.8.1-8.el9_1, +100 more
fixed: vendor fix RHSA-2023:0304
Red Hat Enterprise Linux 6 autocorr-af, autocorr-bg, autocorr-ca, autocorr-cs, autocorr-da, autocorr-de, +60 more Red Hat Enterprise Linux 7 autocorr-af, autocorr-bg, autocorr-ca, autocorr-cs, autocorr-da, autocorr-de, +105 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

The Document Foundation LibreOffice

Classification

Weakness

CWE-326 Inadequate Encryption Strength
CWE-330 Use of Insufficiently Random Values

References

libreoffice.org /about-us/security/advisories/cve-2022-26306
vendor-advisory
openwall.com /lists/oss-security/2022/08/13/1
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2023/03/msg00022.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2022-26306
NVD CVE-2022-26306

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary