LibreOffice allows documents to link to audio and video resources. When a document is opened on Linux, GStreamer is invoked to play the linked media, and an HLS playlist can instruct GStreamer to read both local files and remote URLs. The contents of those local files and the data returned from the remote URLs become embedded in the document itself, exposing sensitive information to the user who opens the file. The vulnerability therefore enables local file read and remote server side request forgery (SSRF).

The affected product is LibreOffice from The Document Foundation on Linux. All versions prior to the release that contains the fix are vulnerable; the advisory does not specify an exact product version number, so any unpatched installation is at risk.

The CVSS score of 6.7 indicates a moderate severity, and because the EPSS score is < 1%, it is unclear how frequently this flaw is being leveraged in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker can supply a malicious document with a crafted HLS playlist, which triggers GStreamer to read local system files and to request resources from internal or external URLs, thereby leaking data and potentially executing GET SSRF actions. The primary attack vector is user opening a malicious document on a Linux environment that has GStreamer enabled.