CVE-2018-10583: LibreOffice and OpenOffice SMB link information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityHigh CVSS (7.5) and very high EPSS with public exploit code, but exploitation requires a victim to open a crafted document and yields information disclosure rather than direct code execution.

What it is

LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious office document, such as an xlink:href=file:// URL inside an office:document-content element in a .odt file. Opening the document causes the application to reach out to an attacker-controlled SMB server, leaking information about the victim. The flaw is an information exposure issue (CWE-200) rated HIGH at CVSS 3.0 7.5.

Impact

An attacker who gets a victim to open a crafted document learns the victim's IP address and can capture NTLM authentication material from the automatic SMB connection, which can be relayed or cracked to gain access to other systems.

Attack surface

Reached over the network when a user opens a malicious .odt or similar office document; no authentication is required and the CVSS vector shows no user interaction requirement, though in practice the victim must open the file. The SMB connection is initiated automatically by the office application.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.78342 (99.558th percentile) and public exploit code exists, including Exploit-DB 44564 and a third-party write-up tagged Exploit.

What to do

• Patch LibreOffice and Apache OpenOffice to versions that fix CVE-2018-10583; apply the referenced Red Hat, Debian and Ubuntu errata.
• Block outbound SMB (TCP 445/139) from user workstations and servers that do not need it.
• Disable automatic link and external content updates in office applications, and warn users about opening untrusted documents.
• Enforce SMB signing and disable NTLM where possible to limit relay and credential-capture value.
• Filter or quarantine office documents containing external file:// or SMB references at the mail and web gateway.

Detection

• Monitor for office application processes (soffice, swriter) making outbound SMB connections to external or unexpected hosts.
• Alert on DNS or SMB traffic to internal or external hosts triggered immediately after a document is opened.
• Search endpoint logs for .odt or office documents containing xlink:href=file:// or SMB paths.
• Watch for NTLM authentication attempts originating from workstations to untrusted SMB servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.