CVE-2025-14714: 
NixOS vulnerability analysis and mitigation

CVE-2025-14714 is an Authentication Bypass vulnerability in LibreOffice on macOS where the application's bundled Python interpreter inherits Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. By executing the bundled interpreter directly, an attacker's scripts can run with LibreOffice's TCC privileges, bypassing macOS security controls. This issue affects LibreOffice versions 25.2.0.1 through 25.2.3.x on macOS only, and was disclosed on December 15, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (LibreOffice Advisory).

The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). LibreOffice bundles a Python interpreter within its macOS application bundle; macOS TCC grants permissions to the application bundle as a whole, and the bundled interpreter inherits those permissions without additional validation. A local attacker with low privileges can directly invoke the bundled Python binary (bypassing the main application's launch controls) and execute arbitrary scripts that operate under LibreOffice's already-granted TCC entitlements — such as access to files, contacts, camera, or microphone — without triggering additional user consent prompts. The fix introduces parent-constraints so that only the main LibreOffice application process is permitted to launch the interpreter with those elevated permissions (LibreOffice Advisory, Infinit Security).

A successful exploit allows a low-privileged local attacker to access sensitive macOS system resources and user data that LibreOffice has been granted permission to use — including files, contacts, camera, microphone, and other TCC-protected resources — without requiring additional user consent or interaction. The scope is changed (macOS TCC boundary is crossed), but integrity and availability are not directly impacted; the primary risk is unauthorized confidentiality exposure of protected data. The vulnerability is limited to macOS systems running the affected LibreOffice versions and requires local access, limiting its blast radius compared to remote vulnerabilities (LibreOffice Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSSv4 exploit maturity is rated "Unreported" (LibreOffice Advisory).

1. Reconnaissance: Identify a macOS system running LibreOffice version 25.2.0.1 through 25.2.3.x where the user has previously granted LibreOffice TCC permissions (e.g., Full Disk Access, Contacts, Camera, or Microphone).
2. Locate the bundled interpreter: Navigate to the LibreOffice application bundle to find the embedded Python binary, typically at a path such as /Applications/LibreOffice.app/Contents/Frameworks/LibreOfficePython.framework/Versions/Current/bin/python3.
3. Craft a malicious script: Write a Python script that accesses TCC-protected resources (e.g., reads files from ~/Library/, enumerates contacts, or captures audio/video) that would normally require explicit user authorization.
4. Execute directly: Invoke the bundled Python interpreter directly from a local shell session (with low-privilege user access), passing the malicious script as an argument. Because the interpreter inherits LibreOffice's TCC entitlements, the script executes with those elevated permissions without triggering a macOS consent dialog.
5. Exfiltrate or abuse data: Use the script's access to read sensitive files, extract contact data, or access other protected resources, then exfiltrate or leverage the data for further attack stages (LibreOffice Advisory, Infinit Security).

• Process: Unexpected execution of the LibreOffice-bundled Python binary (e.g., LibreOfficePython or python3 spawned from within the LibreOffice app bundle) outside of a normal LibreOffice session; Python processes with a parent process that is not the main LibreOffice application.
• File System: Unusual script files (.py) created in temporary directories or user home directories; unexpected access to TCC-protected directories (e.g., ~/Library/Application Support/AddressBook/, ~/Pictures/) by Python processes.
• Logs: macOS Unified Log entries showing TCC access grants attributed to the LibreOffice bundle identifier but initiated by a Python subprocess; tccd log entries for resource access not correlated with an active LibreOffice UI session.
• Network: Outbound network connections from a Python process associated with the LibreOffice bundle to unexpected external hosts, potentially indicating data exfiltration.

LibreOffice has released version 25.2.4 (25.2.4.1) which addresses this vulnerability by implementing parent-constraints that restrict the bundled Python interpreter to only be launched by the main LibreOffice application process. Users on macOS running LibreOffice 25.2.x should upgrade to version 25.2.4 or later immediately. As an interim measure, organizations should consider restricting local user access on systems where LibreOffice is installed and reviewing/revoking unnecessary TCC permissions granted to LibreOffice via System Settings > Privacy & Security (LibreOffice Advisory).

The vulnerability was assigned by The Document Foundation and disclosed on December 15, 2025. It was picked up by security aggregators including INCIBE-CERT, CCN-CERT, and Tenable (Nessus plugin 278970), indicating standard industry tracking. A technical write-up was published by Infinit Security covering the TCC bypass mechanism. Community reaction has been limited given the low EPSS score and absence of active exploitation (Infinit Security, Tenable).