A vulnerability in LibreOffice allows remote attackers to exfiltrate sensitive local information by tricking users into opening documents containing specifically crafted malicious URLs.

This issue is an exposure of sensitive information (CWE-200) occurring because the application fails to properly sanitize package content provider paths in URLs. An attacker with low privileges can exploit this by enticing a user to open a document, triggering an unauthorized expansion of local environment variables or configuration values.

Successful exploitation results in the unauthorized disclosure of potentially sensitive local system information, which could facilitate further attacks or compromise user privacy. While the CVSS score of 6.7 classifies this as a medium severity issue, the risk of data leakage from internal environments makes it a significant concern for organizations handling sensitive documentation.

Immediate Action: Update LibreOffice to version 26.2.5 or later to ensure the package content provider validation logic is correctly applied.

Proactive Monitoring: Monitor network egress traffic for unusual outbound requests originating from systems where LibreOffice is heavily utilized.

Compensating Controls: Implement endpoint security policies that restrict the ability of desktop applications to initiate unauthorized outbound network connections to unknown or untrusted external servers.

Public Exploit Available: Unknown

Organizations should prioritize patching LibreOffice installations to the latest version to prevent the potential exfiltration of sensitive information. Given that this vulnerability requires user interaction to execute, security awareness training regarding the risks of opening untrusted documents remains an essential secondary layer of defense.