CVE-2025-64407 is a missing authorization vulnerability (CWE-862) affecting Apache OpenOffice versions through 4.1.15. Apache OpenOffice documents can embed links using specific URI schemes that reference external files or resources. Due to insufficient authorization checks, the application automatically loads these external links without prompting the user for permission. This behavior enables an attacker to craft malicious documents that, when opened, cause the application to fetch external resources silently. The external links can be designed to include sensitive system information such as environment variables or configuration files, which are then transmitted externally, leading to information disclosure (CWE-201). The vulnerability requires no privileges and no user interaction beyond opening the malicious document. The CVSS v3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact without integrity or availability effects. The issue was reserved and published in November 2025 and is fixed in Apache OpenOffice 4.1.16. LibreOffice has a similar vulnerability tracked as CVE-2024-12426, indicating a shared codebase or similar design flaw. No known exploits have been reported in the wild to date.

For European organizations, this vulnerability poses a risk of unauthorized disclosure of sensitive system information through crafted documents. Attackers could leverage this flaw to gather environment variables and configuration data, which may include network settings, user information, or other internal details useful for further attacks or reconnaissance. This is particularly concerning for sectors handling sensitive or regulated data, such as finance, healthcare, and government agencies. The lack of user interaction requirement increases the risk of automated or targeted spear-phishing campaigns. While the vulnerability does not allow code execution or system compromise directly, the information leakage could facilitate subsequent attacks. Organizations relying on Apache OpenOffice for document handling or collaboration are at risk until they apply the patch. The medium severity score reflects the limited scope of impact but significant confidentiality concerns.

European organizations should immediately upgrade all Apache OpenOffice installations to version 4.1.16 or later, which contains the fix for this vulnerability. Until upgrades are completed, organizations should implement strict email filtering and sandboxing to detect and block malicious documents exploiting this flaw. Disable or restrict the automatic loading of external links or URI schemes within OpenOffice documents via configuration or group policy if possible. Educate users to be cautious when opening documents from untrusted sources, especially those containing external links. Network monitoring for unusual outbound requests from client machines opening OpenOffice documents can help detect exploitation attempts. Additionally, consider deploying endpoint detection and response (EDR) solutions capable of identifying suspicious document behaviors. Regularly review and audit document handling policies to minimize exposure to malicious content.