Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4kzn-nb3d-e3c8
Vulnerability ID VCID-4kzn-nb3d-e3c8
Aliases CVE-2024-5261
Summary Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents. LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers. In affected versions of LibreOffice, when used in LibreOfficeKit mode only, then curl's TLS certification verification was disabled (CURLOPT_SSL_VERIFYPEER of false) In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true. This issue affects LibreOffice before version 24.2.4.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-295 Improper Certificate Validation
System Score Found at
epss 0.00532 https://api.first.org/data/v1/epss?cve=CVE-2024-5261
epss 0.00532 https://api.first.org/data/v1/epss?cve=CVE-2024-5261
epss 0.00532 https://api.first.org/data/v1/epss?cve=CVE-2024-5261
epss 0.00532 https://api.first.org/data/v1/epss?cve=CVE-2024-5261
epss 0.00532 https://api.first.org/data/v1/epss?cve=CVE-2024-5261
epss 0.00532 https://api.first.org/data/v1/epss?cve=CVE-2024-5261
epss 0.00532 https://api.first.org/data/v1/epss?cve=CVE-2024-5261
epss 0.00532 https://api.first.org/data/v1/epss?cve=CVE-2024-5261
epss 0.00532 https://api.first.org/data/v1/epss?cve=CVE-2024-5261
epss 0.00532 https://api.first.org/data/v1/epss?cve=CVE-2024-5261
epss 0.00532 https://api.first.org/data/v1/epss?cve=CVE-2024-5261
cvssv3.1 8.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv4 10 https://www.libreoffice.org/about-us/security/advisories/cve-2024-5261
ssvc Track https://www.libreoffice.org/about-us/security/advisories/cve-2024-5261
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-5261
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cve-2024-5261 https://www.libreoffice.org/about-us/security/advisories/cve-2024-5261
USN-6877-1 https://usn.ubuntu.com/6877-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://www.libreoffice.org/about-us/security/advisories/cve-2024-5261
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-06-25T13:27:12Z/ Found at https://www.libreoffice.org/about-us/security/advisories/cve-2024-5261
Exploit Prediction Scoring System (EPSS)
Percentile 0.67272
EPSS Score 0.00532
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T17:02:40.766166+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/6877-1/ 38.0.0