Vulnerability · Published Apr 27, 2025 · Assigned by Document Fdn.
CVE-2025-2866PDF signature forgery with adbe.pkcs7.sha1 SubFilter
Low 2.4
In plain English
A low-severity security flaw in LibreOffice from The Document Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libreoffice | 4:7.4.7-1+deb12u8 | DSA-5908-1 |
| Debian:12 | libreoffice | 4:7.4.7-1+deb12u8 | DEBIAN-CVE-2025-2866 |
| Debian:13 | libreoffice | 4:25.2.2-1 | DEBIAN-CVE-2025-2866 |
| Debian:14 | libreoffice | 4:25.2.2-1 | DEBIAN-CVE-2025-2866 |
| Ubuntu:22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.10 | USN-7504-1 |
| Ubuntu:22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.10 | UBUNTU-CVE-2025-2866 |
| Ubuntu:24.04:LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.4 | UBUNTU-CVE-2025-2866 |
| Ubuntu:24.04:LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.4 | USN-7504-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Document Foundation | LibreOffice | 24.8 – before < 24.8.625.2 – before < 25.2.2 |
Weakness: CWE-347 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N