Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-sega-433y-v7bb
Vulnerability ID VCID-sega-433y-v7bb
Aliases CVE-2019-9851
Summary security update
Status Published
Exploitability 2.0
Weighted Severity 7.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-94 Improper Control of Generation of Code ('Code Injection')
System Score Found at
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-9851.json
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
epss 0.85784 https://api.first.org/data/v1/epss?cve=CVE-2019-9851
cvssv3 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-9851.json
https://api.first.org/data/v1/epss?cve=CVE-2019-9851
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9850
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9851
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9852
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9853
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1744866 https://bugzilla.redhat.com/show_bug.cgi?id=1744866
CVE-2019-9851 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/47298.rb
RHSA-2020:1151 https://access.redhat.com/errata/RHSA-2020:1151
RHSA-2020:1598 https://access.redhat.com/errata/RHSA-2020:1598
USN-4102-1 https://usn.ubuntu.com/4102-1/
Data source Metasploit
Description LibreOffice comes bundled with sample macros written in Python and allows the ability to bind program events to them. LibreLogo is a macro that allows a program event to execute text as Python code, allowing RCE. This module generates an ODT file with a dom loaded event that, when triggered, will execute arbitrary python code and the metasploit payload.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date July 16, 2019
Platform Python
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/fileformat/libreoffice_logo_exec.rb
Data source Exploit-DB
Date added Aug. 21, 2019
Description LibreOffice < 6.2.6 Macro - Python Code Execution (Metasploit)
Ransomware campaign use Unknown
Source publication date Aug. 21, 2019
Exploit type remote
Platform multiple
Source update date Aug. 21, 2019
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-9851.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.99375
EPSS Score 0.85784
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:59:48.699742+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 38.0.0