{
  "threat_severity" : "Low",
  "public_date" : "2025-12-15T10:30:55Z",
  "bugzilla" : {
    "description" : "LibreOffice: LibreOffice: Authentication Bypass leading to privilege escalation via bundled interpreter execution",
    "id" : "2422247",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2422247"
  },
  "cvss3" : {
    "cvss3_base_score" : "3.9",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
    "status" : "draft"
  },
  "cwe" : "CWE-288",
  "details" : [ "An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle\nBy executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges\nIn fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions\nThis issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.", "A flaw was found in LibreOffice. This vulnerability allows privilege escalation where an attacker's scripts run with the application's Transparency, Consent, and Control (TCC) privileges via direct execution of the bundled interpreter." ],
  "statement" : "In the Red Hat context, this vulnerability is rated Low and does not affect Red Hat Enterprise Linux or Fedora as the flaw specifically impacts LibreOffice on macOS.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "libreoffice",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "libreoffice",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "libreoffice",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "libreoffice",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-14714\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-14714\nhttps://www.libreoffice.org/about-us/security/advisories/cve-2025-14714" ],
  "name" : "CVE-2025-14714",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}