This vulnerability involves the exposure of sensitive information due to improper handling of URLs in LibreOffice documents. Specifically, URLs could be crafted to expand environment variables or INI file values, which could then be exfiltrated to a remote server when the document is opened. The prior mitigation for CVE-2024-12426 was incomplete because it did not recognize all naming variations of the package content provider, allowing some malicious URLs to bypass the check. The fix ensures that the package content provider is correctly matched during URL validation to prevent such expansions.

An attacker could craft a document containing specially constructed URLs that cause LibreOffice to expand environment variables or INI file values, potentially leaking sensitive information to a remote server when the document is opened. This could lead to unauthorized disclosure of sensitive data. The vulnerability requires local attack vector with low privileges and user interaction to open the document. The CVSS 4.0 score is 6.7 (medium severity), reflecting the moderate risk of sensitive information exposure without direct code execution or privilege escalation.

No explicit patch links are provided, and the vendor advisory is not included in the input data. Therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates that fixed versions properly match the package content provider during URL checks, so upgrading to a fixed version when available is recommended. Until then, avoid opening untrusted documents containing suspicious URLs.