CVE-2022-26305 Execution of Untrusted Macros Due to Improper Certificate Validation
Attackers can bypass macro trust checks by spoofing certificate details, tricking users into executing malicious code in LibreOffice.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-26305?
CVE-2022-26305 is a high-severity vulnerability in Libreoffice Libreoffice, published on 25 Jul 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate. An adversary could therefore create an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice would present as belonging to the trusted author, potentially leading to the user to execute arbitrary code contained in macros improperly trusted. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
Weakness: CWE-295
Which versions are affected by CVE-2022-26305?
It affects 1 product.
Products include Libreoffice Libreoffice.
How do I fix CVE-2022-26305?
Upgrade to a fixed version.
Is CVE-2022-26305 being exploited?
There is no known exploitation of CVE-2022-26305 in the wild and no public exploit code.
Other vulnerabilities in Libreoffice Libreoffice
Sources
Also known as DEBIAN-CVE-2022-26305, GHSA-fm9c-xcj2-2j5g, UBUNTU-CVE-2022-26305.