CVE-2019-9847: document foundation libreoffice Improper Input Validation
Vulnerability summary
CVE-2019-9847 is a high (CVSS 7.8) Improper Input Validation vulnerability in document foundation libreoffice. EPSS estimates a 1.01% chance of exploitation in the next 30 days, higher than 62.4% of scored vulnerabilities.
Timeline
- 09-05-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. If the hyperlink is activated by the victim the executable target is unconditionally launched. Under Windows and macOS when processing a hyperlink target explicitly activated by the user there was no judgment made on whether the target was an executable file, so such executable targets were launched unconditionally. This issue affects: All LibreOffice Windows and macOS versions prior to 6.1.6; LibreOffice Windows and macOS versions in the 6.2 series prior to 6.2.3.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.01%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
0.00 pp
From 1.01% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Document foundation1 product
- libreoffice≥ unspecified, < 6.1.6 | ≥ unspecified, < 6.2.3
Libreoffice1 product
- libreoffice< 6.1.6 | ≥ 6.2, < 6.2.3
2 vendors · 2 products