Skip to content
Sign in
10.0 Critical

CVE-2024-5261 Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification…

Description

Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents. LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers. In affected versions of LibreOffice, when used in LibreOfficeKit mode only, then curl's TLS certification verification was disabled (CURLOPT_SSL_VERIFYPEER of false) In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true. This issue affects LibreOffice before version 24.2.4.

Affected products and versions

Product Affected versions Fixed in
LibreOffice 24.2 24.2 → < 24.2.4 24.2.4
libreoffice 24.2 earliest → < 24.2.4 24.2.4

Other CVEs of LibreOffice

The 48 CVEs of LibreOffice →
CVE-2026-76181 Heap buffer overflow in dBASE index import 5.4 Medium CVE-2026-63270 URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information… 6.7 Medium CVE-2026-63269 LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer 6.7 Medium CVE-2026-63267 LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document 6.7 Medium
Track this CVE