Analyst readout for executives and security teams
Plain-English summary
A malicious RTF document can crash LibreOffice versions before 4.3.5 and may allow code execution. The main business concern is legacy desktops or servers that open outside documents with old LibreOffice builds. The sources do not show known active exploitation.
Executive priority
Address during legacy software cleanup, with higher priority for teams handling external documents. The issue is old, but outdated office suites remain attractive because document opening is a common user workflow and possible code execution is cited.
Technical view
CVE-2014-9093 describes an invalid write operation in LibreOffice before 4.3.5 when processing crafted RTF files. Public records state denial of service and possible arbitrary code execution, but provide no CVSS, CWE, or detailed affected component data in the supplied bundle.
Likely exposure
Exposure is most likely where LibreOffice before 4.3.5 remains installed and users open RTF files from email, downloads, shared drives, or external parties. Modern managed environments are less likely exposed unless legacy images, embedded workflows, or unsupported Linux distributions remain in use.
Exploitation context
The attack path requires a crafted RTF file being processed by vulnerable LibreOffice. The supplied sources do not cite exploitation in the wild, and CISA KEV status is false. Treat exploitation claims beyond crash and possible code execution as unproven from this bundle.
Researcher notes
Evidence is limited to public CVE text, mailing-list references, bug tracker confirmation, and distribution advisories. The bundle does not provide root-cause detail, exploit maturity, fixed commit, CVSS, or affected subcomponent. Avoid overstating exploitability beyond possible arbitrary code execution.
Mitigation direction
- Upgrade LibreOffice to 4.3.5 or later, or a vendor package containing the fix.
- Prioritize endpoints and workflows that open external RTF documents.
- Quarantine or restrict untrusted RTF attachments until vulnerable systems are remediated.
- Retire unsupported LibreOffice builds and legacy OS images.
- Check vendor advisories for distribution-specific fixed package versions.
Validation and detection
- Inventory LibreOffice versions and flag any installation before 4.3.5.
- Compare Linux package versions against relevant Fedora, Debian, Ubuntu, or Gentoo advisories.
- Review email and web controls for RTF attachment handling.
- Check endpoint telemetry for legacy LibreOffice launches against external documents.
- Do not validate by opening suspicious crafted files on production systems.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2014-9093 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- [oss-security] 20141119 CVE Request: LibreOffice -- several issuesCVE reference · mailing-list, x_refsource_MLIST
- https://bugs.freedesktop.org/show_bug.cgi?id=86449CVE reference · x_refsource_CONFIRM
- FEDORA-2014-15486CVE reference · vendor-advisory, x_refsource_FEDORA
- DSA-3163CVE reference · vendor-advisory, x_refsource_DEBIAN
- [oss-security] 20141126 Re: CVE Request: LibreOffice -- several issuesCVE reference · mailing-list, x_refsource_MLIST
- USN-2578-1CVE reference · vendor-advisory, x_refsource_UBUNTU
- GLSA-201603-05CVE reference · vendor-advisory, x_refsource_GENTOO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.