Arbitrary File Creation Vulnerability in LibreOffice

A vulnerability identified as CVE-2024-7737 exists in LibreOffice versions prior to 24.2.6. The flaw is caused by the improper handling of specific document features within the software, which may allow an unauthenticated remote attacker to create arbitrary files on a victim's local system when a maliciously crafted document is opened. This vulnerability poses a risk of unauthorized file system write operations. Users are advised to upgrade to the latest stable version of LibreOffice to mitigate this risk.

Impact

Successful exploitation allows for unauthorized file creation on the targeted host. Depending on the location and contents of the generated files, this could facilitate further malicious activities such as the overwriting of system configuration files, the placement of files in startup directories, or the creation of local execution artifacts. The vulnerability affects users on Windows, Linux, and macOS platforms.

Recommendation

Update all LibreOffice installations to version 24.2.6 or later to address the vulnerability documented in CVE-2024-7737.