CVE-2022-3140

Name of the Vulnerable Software and Affected Versions LibreOffice versions 7.3.0 through 7.3.5 LibreOffice versions 7.4.0

Description The issue is related to the implementation of the 'vnd.libreoffice.command' scheme in LibreOffice, which allows for the execution of internal macros with arbitrary arguments. This can result in arbitrary script execution without warning when a link using this scheme is clicked on or activated by document events.

Recommendations For LibreOffice versions 7.3.0 through 7.3.5, update to version 7.3.6 to resolve the issue. For LibreOffice version 7.4.0, update to version 7.4.1 to resolve the issue. As a temporary workaround, consider disabling the use of the 'vnd.libreoffice.command' scheme to minimize the risk of exploitation.