CVE-2018-16858: LibreOffice directory traversal enables macro code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8, public exploit code and very high EPSS make this a high-risk code execution flaw despite no KEV listing.

What it is

LibreOffice before 6.0.7 and 6.1.3 is vulnerable to a directory traversal flaw that lets a crafted document execute arbitrary macros bundled with it. An attacker can make LibreOffice run a Python method from a script at any file system location relative to the install path, turning a simple document open into code execution.

Impact

An attacker gains arbitrary code execution in the context of the user who opens the document, with high impact to confidentiality, integrity and availability. This can lead to full system compromise of the victim's account.

Attack surface

The flaw is reached by opening a malicious document in LibreOffice; no authentication is required and the CVSS vector indicates no user interaction beyond opening the file. The attack is network-deliverable as a file.

Exploitation

Public exploit code exists (ExploitDB, Packet Storm, Rapid7 module) and EPSS is 0.673 with a 99.3 percentile, indicating high likelihood of exploitation; it is not listed in CISA KEV.

What to do

• Upgrade LibreOffice to 6.0.7, 6.1.3 or later, or apply the vendor or distribution patches (e.g. Red Hat RHSA-2019:2130).
• Disable or restrict macro execution from untrusted documents via LibreOffice security settings and policy.
• Block or quarantine untrusted office documents at email and web gateways, and warn users against opening unexpected attachments.
• Run LibreOffice with least privilege and consider sandboxing or application control to limit macro execution impact.

Detection

• Monitor for LibreOffice processes spawning unusual child processes such as python, sh, cmd or powershell.
• Alert on file writes or reads by LibreOffice in unexpected paths outside user document directories.
• Search endpoint logs for document opens followed by script interpreter execution or network connections from LibreOffice.
• Use file reputation and sandbox detonation for office documents containing macros or embedded scripts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.