CVE-2025-14714: TCC Bypass via Inherited Permissions in Bundled Interpreter
An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions This issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14714?
CVE-2025-14714 has been classified with a severity rating indicating a significant risk related to Authentication Bypass.
How do I fix CVE-2025-14714?
To fix CVE-2025-14714, update the LibreOffice application to version 25.2.5 or later.
Which versions of LibreOffice are affected by CVE-2025-14714?
CVE-2025-14714 affects LibreOffice versions from 25.2 to 25.2.4.
What does CVE-2025-14714 allow an attacker to do?
CVE-2025-14714 allows an attacker to bypass authentication by executing a bundled Python interpreter with elevated permissions.
Is there a workaround for CVE-2025-14714 if I cannot update immediately?
Currently, there is no official workaround for CVE-2025-14714, so it is recommended to apply the update as soon as possible.