Medium severity · published Jan 7, 2025
CVE-2024-12426
URL fetching can be used to exfiltrate arbitrary INI file values and environment variables
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice.
URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links.
This issue affects LibreOffice: from 24.8 before < 24.8.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibreOffice · The Document Foundation
24.8 before < 24.8.4 · source: vendor, NVD
DL
Debian Linux · Debian
11.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12426
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12426
Vendor Advisory
https://www.libreoffice.org/about-us/security/advisories/cve-2024-12426
Mailing List
https://lists.debian.org/debian-lts-announce/2025/01/msg00013.html
More from LibreOffice
8.5
CVE-2026-63277
RCE via calcext:data-mappings, sql provider and jdbc connector
7.8
CVE-2026-8357
Heap buffer overflow in Calc formula compilation
7.8
CVE-2026-4430
Heap Buffer Overflow in AgileEngine
7.3
CVE-2026-6040
Heap use-after-free in ODF number-format blank-width parsing
6.8
CVE-2026-63266
Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality