CVE-2019-9855

CVE-2019-9855 is a critical vulnerability in LibreOffice versions prior to 6.2.7 and 6.3.1, specifically affecting Windows installations. It allowed malicious documents to bypass a security control designed to prevent LibreLogo, a script interpreter, from executing arbitrary Python commands via document event handlers. This was due to a flaw in how LibreOffice handled Windows 8.3 path equivalences, enabling an attacker to trigger LibreLogo execution through a filename pseudonym. The vulnerability has a CVSS score of 9.8 (Critical), indicating a high-impact attack that can be executed remotely without user interaction (AV:N/UI:N) and with low attack complexity (AC:L). Successful exploitation could lead to complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) of the affected system. There is currently no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or significant community discussion or media coverage has been identified for this CVE.