CVE-2019-9851: LibreOffice LibreLogo global script event validation bypass allows Python execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no privileges or user interaction required and a very high EPSS score, and successful exploitation yields arbitrary code execution on the host.

What it is

LibreOffice bundles LibreLogo, a programmable turtle graphics script that can execute arbitrary Python commands embedded in a document. A prior fix for CVE-2019-9848 blocked calling LibreLogo from document event script handlers, but global script events such as document-open were not validated the same way, so a crafted document could still trigger script execution. Fixed versions validate global script event handlers equivalently to document script event handlers.

Impact

An attacker who gets a victim to open a crafted document can execute arbitrary Python code in the context of the LibreOffice process, leading to code execution on the host with the victim's privileges.

Attack surface

Reached by opening a malicious document in an affected LibreOffice build; the CVSS vector is network, no privileges and no user interaction, though in practice delivery requires the target to open the file. No authentication is needed.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.783 probability, 99.6th percentile) and public references include a Packet Storm entry titled LibreOffice Macro Python Code Execution, indicating public technical detail exists.

What to do

• Upgrade LibreOffice to 6.2.6 or later, or apply the vendor and distribution updates referenced in the advisories (Ubuntu USN-4102-1, Debian DSA-4501, openSUSE and Fedora announcements).
• Disable or restrict LibreLogo and macro execution via LibreOffice security settings, and set macro security to high so untrusted documents cannot run scripts.
• Block or quarantine untrusted office documents at email and web gateways, and strip or inspect embedded scripts before delivery.
• Where LibreOffice is not required, remove it from endpoints that handle untrusted documents, or open untrusted files in a sandboxed or converted form.
• Monitor vendor advisories for the bundled LibreOffice packages on each distribution and keep them current.

Detection

• Alert on LibreOffice or soffice processes spawning child processes such as python, sh, cmd or powershell, which is abnormal for normal document editing.
• Monitor for document-open or other global script event activity and LibreLogo usage in documents, including files containing LibreLogo or Basic macro content.
• Hunt for office documents received from external senders that contain embedded scripts, and correlate with subsequent process creation on the endpoint.
• Review endpoint logs for LibreOffice crashes or unexpected child process trees shortly after a document is opened.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.