Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

LibreOffice bug bounty programs

libreoffice.org Updated

LibreOffice runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
10
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program LibreOffice runs.

  • LibreOffice

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

10 targets. 6 excluded.

  • https://www.libreoffice.org

    Web

  • Digital-signature validation for both document and macro signatures.

    Products and areas

  • Formula parsing and compilation in Calc (for example the CVE-2026-8357 heap overflow during formula compilation) and formula/OLE handling in Writer and Math.

    Products and areas

  • Graphics and embedded-object import filters parsed on document load, including EMF/EMF+, WMF, DXF, and SVG.

    Products and areas

  • Legacy binary import filters, DOC, XLS, and PPT (MS Office 97-2003) plus RTF, handled through the writerfilter, oox, and filter modules.

    Products and areas

  • Multiple concurrently maintained release lines receive fixes, including the fresh and still (LTS-style) branches such as 26.2.x and 25.8.x.

    Products and areas

  • ODF import and parsing for ODT, ODS, and ODP, including the OpenDocument encryption and signature stack.

    Products and areas

  • OOXML import filters for DOCX, XLSX, and PPTX, covering document and text-box parsing, deferred parser-event replay, and encryption-header handling, the suite's richest historical bug surface (for example the CVE-2026-6047 type-confusion in OOXML text-box import and the CVE-2026-4430 out-of-bounds write from an OOXML encryption salt mismatch).

    Products and areas

  • The macro and scripting subsystem: Basic macros, document-embedded scripting, and the surrounding security controls (macro security levels, auto-execution, and event bindings).

    Products and areas

  • URL and hyperlink handling together with password and encryption management for protected documents.

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Antivirus false positives or heuristic detections against LibreOffice binaries or installers.

  • Defects in bundled third-party libraries that should be attributed upstream, unless LibreOffice's own use of them is the flaw.

  • Documented, intended behavior of macros and scripting when the user explicitly enables or runs them.

  • End-of-life release branches that no longer receive security fixes.

  • Non-security functional bugs, which belong in the public Bugzilla rather than the security contact.

  • Reports that require the attacker to already hold local code execution or control of the user's configuration.

Recent changes

Reward and scope changes across every LibreOffice program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in LibreOffice products, from the NVD.

Search NVD
  • CVE-2026-4430 Medium

    Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice: from 26.2 before 26.2.3, from 25.8 before 25.8.7.

  • CVE-2025-14714 Low

    An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges In fixed versions parent-constraints are used to allow only the ma

  • CVE-2025-2866 Low

    Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.

  • CVE-2021-25635 Medium

    An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a valid signature issued by a trusted person This issue

  • CVE-2025-1080 High

    LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary argume

  • CVE-2025-0514 High

    Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.This issue affects LibreOffice: from 24.8 before < 24.8.5.

  • CVE-2024-12426 Medium

    Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. This issue affects LibreOffice: from 24.8 before

  • CVE-2024-12425 Low

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4.

About this page

This page gathers every public program listed under libreoffice.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.