VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Apr 27, 2025· Updated Jun 17, 2026

CVE-2025-2866

CVE-2025-2866

Description

Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation.

In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid

This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Libreoffice/Libreoffice6 versions
    cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*range: >=24.8.0.1,<24.8.6.0
    • cpe:2.3:a:libreoffice:libreoffice:24.8.0.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:libreoffice:libreoffice:24.8.0.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:libreoffice:libreoffice:25.2.0.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:libreoffice:libreoffice:25.2.0.0:beta1:*:*:*:*:*:*
    • (no CPE)range: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2
  • The Document Foundation/Libreoffice Onlinecpe-rescue
    Range: 24.8

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.