Loading story…
A high-severity vulnerability (CVE-2025-64403) was identified in Apache OpenOffice Calc, where remote documents could be loaded automatically via "external data sources" without prompting the user. This missing authorization flaw affects versions up to 4.1.15 and could allow attackers to craft malicious spreadsheet files that retrieve external content, potentially exposing users to further attacks or data exfiltration. The issue was addressed in version 4.1.16, and users are strongly advised to update to the latest release to mitigate the risk.
In addition to this specific vulnerability, Apache OpenOffice released a security update addressing a total of seven flaws, including memory corruption issues and the unprompted remote content loading vulnerability. The coordinated disclosure and patch highlight the importance of keeping productivity software up to date, as attackers increasingly target document-based vectors for initial access and exploitation. Organizations using OpenOffice should review their deployment and ensure all instances are patched promptly.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-64403 was publicly disclosed as a high-severity vulnerability in Apache OpenOffice Calc that allows crafted spreadsheet documents to load external data sources without user prompts. The issue is remotely exploitable with user interaction and carries a CVSS 3.1 score of 8.1.
Apache OpenOffice released version 4.1.16 to address seven security flaws, including memory corruption issues and a Calc flaw that could load remote external data sources without prompting users. The fixes apply to versions through 4.1.15.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several **remote code execution** vulnerabilities affecting **Microsoft Office** and **Microsoft Excel**, including `CVE-2025-24057`, `CVE-2025-24075`, and `CVE-2025-47162`. The issues were listed in the Microsoft Security Update Guide as Office-family flaws that could allow arbitrary code execution if successfully exploited. The disclosures indicate that the affected attack surface spans both the broader Office suite and Excel specifically, underscoring continued risk from malicious documents and content processed by productivity software. Organizations using Microsoft Office should prioritize review of the relevant advisories and deployment of associated security updates for the affected products tied to these CVEs.
Jul 12, 2026
A high-severity use-after-free (UAF) vulnerability, tracked as CVE-2025-62557, has been identified in Microsoft Office's document parsing component. This flaw allows attackers to achieve local remote code execution (RCE) by tricking the application into parsing a specially crafted Office file, potentially granting the attacker code execution with the privileges of the affected process. The vulnerability is notable because it does not require prior privileges and leverages Office's widespread use as an initial access vector, especially through phishing and document-based attacks. Microsoft has released an advisory and patch as part of its December 2025 update rollup, and security experts recommend immediate remediation due to the high CVSS v3.1 base score of 8.4 and the risk of exploitation in enterprise environments. The vulnerability is confirmed by both Microsoft's Security Response Center and independent vulnerability aggregators, which highlight the risk of memory corruption and the importance of verifying patch deployment across all affected Office SKUs. While there is some discrepancy in public reporting regarding the criticality label, the consensus is that this UAF bug poses a significant threat due to the ease of delivery and the potential for exploitation without macros or scripting. Organizations are urged to consult the official Microsoft advisory for precise patch information and to prioritize mitigation efforts to reduce exposure to this RCE vulnerability.
Jun 29, 2026
Microsoft published a long series of security advisories for **remote code execution** vulnerabilities affecting core Office components, with the largest concentration in **Excel** and **Word**. The disclosures include Excel flaws such as `CVE-2024-49026`, `CVE-2024-49069`, `CVE-2025-21362`, `CVE-2025-21381`, `CVE-2025-21387`, `CVE-2025-24082`, `CVE-2025-62553`, `CVE-2026-26107`, `CVE-2026-26109`, `CVE-2026-26112`, and `CVE-2026-40359`, alongside Word issues including `CVE-2025-24077`, `CVE-2025-24078`, `CVE-2025-47170`, `CVE-2025-49700`, `CVE-2025-59222`, `CVE-2026-23657`, and `CVE-2026-33095`. Microsoft also listed related RCE bugs in **Microsoft Office** (`CVE-2025-21392`), **PowerPoint** (`CVE-2025-54908`), **Inbox COM Objects (Global Memory)** (`CVE-2025-58730`), and the **Visual Studio Code Python Extension** (`CVE-2025-49714`). One of the few entries with technical detail, **`CVE-2026-40359`**, describes an **Important** Excel use-after-free flaw (`CWE-416`) with a **CVSS 3.1 score of 7.8** that can let an attacker execute code if a user opens a malicious Office file. Microsoft said the bug was **not publicly disclosed**, **not exploited in the wild**, and **less likely** to be exploited at the time of publication, adding that the **Preview Pane is not an attack vector** and that a fix is available. Taken together, the advisories show Microsoft continuing to address document-driven code execution risks across Office products, where successful exploitation generally depends on **user interaction with crafted files** rather than direct network exposure.
Jun 29, 2026