CVE-2018-10583

HIGH

LibreOffice 6.0.3 - Apache OpenOffice Writer 4.1.5 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 5 public exploits for CVE-2018-10583. PoCs published by Richard Davy, MrTaherAmine, octodi, including Metasploit module auxiliary/fileformat/odt_badodt.

AI-analyzed exploit summary This script creates a malicious ODF file that exploits CVE-2018-10583 to leak NetNTLM credentials by embedding a remote object reference in the document. It automates the creation of a crafted ODT file that, when opened, triggers an SMB connection to an attacker-controlled server.

Description

An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.

Exploits (5)

exploitdb WORKING POC
by Richard Davy · pythonlocalwindows
https://www.exploit-db.com/exploits/44564

This script creates a malicious ODF file that exploits CVE-2018-10583 to leak NetNTLM credentials by embedding a remote object reference in the document. It automates the creation of a crafted ODT file that, when opened, triggers an SMB connection to an attacker-controlled server.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: LibreOffice 6.0.3, OpenOffice 4.1.5
No auth needed
Prerequisites: Python with ezodf library · Attacker-controlled SMB server (e.g., Responder)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 9 stars
by MrTaherAmine · poc
https://github.com/MrTaherAmine/CVE-2018-10583

This PoC creates a malicious ODF file that exploits CVE-2018-10583 to leak NetNTLM credentials by embedding an SMB connection in the document. It uses the ezodf library to generate the file and requires a listener (e.g., Responder) to capture the credentials.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: LibreOffice 6.0.3, Apache OpenOffice Writer 4.1.5
No auth needed
Prerequisites: Python with ezodf library · Listener setup (e.g., Responder)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by octodi · poc
https://github.com/octodi/CVE-2018-10583

This PoC generates a malicious ODF file that exploits CVE-2018-10583 to leak NetNTLM credentials when opened in vulnerable versions of LibreOffice or OpenOffice. It creates an ODT file with a crafted content.xml that triggers an external resource request to an attacker-controlled server.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: LibreOffice 6.0.3, OpenOffice 4.1.5
No auth needed
Prerequisites: ezodf Python module · attacker-controlled server to capture NetNTLM hashes
devstral-2 · analyzed Feb 16, 2026 Full analysis →
inthewild WORKING POC
poc
https://github.com/taharamine/cve-2018-10583

This PoC creates a malicious ODF file that exploits CVE-2018-10583 to leak NetNTLM credentials by embedding an SMB connection in the document. It uses the ezodf library to generate the file and requires a listener (e.g., Responder) to capture the credentials.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: LibreOffice 6.0.3, Apache OpenOffice Writer 4.1.5
No auth needed
Prerequisites: ezodf library · listener setup (e.g., Responder)
devstral-2 · analyzed Feb 23, 2026 Full analysis →
metasploit WORKING POC
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/fileformat/odt_badodt.rb

This Metasploit module generates a malicious ODT file that exploits CVE-2018-10583 in LibreOffice 6.03 and Apache OpenOffice 4.1.5. The ODT file contains a crafted content.xml that points to an SMB listener for hash capture.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: LibreOffice 6.03, Apache OpenOffice 4.1.5
No auth needed
Prerequisites: SMB listener setup · Target opens malicious ODT file
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (9)

Core 9
Core References
Issue Tracking, Third Party Advisory x_refsource_confirm
https://security-tracker.debian.org/tracker/CVE-2018-10583
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3054
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3883-1/
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44564/
Exploit, Mitigation, Third Party Advisory x_refsource_misc
http://secureyourit.co.uk/wp/2018/05/01/creating-malicious-odt-files/
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/Oct/26

Scores

CVSS v3 7.5
EPSS 0.7189
EPSS Percentile 98.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (10)
apache/openoffice 4.1.5
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
debian/debian_linux 7.0
debian/debian_linux 8.0
debian/debian_linux 9.0
libreoffice/libreoffice 6.0.3
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_server 7.0
redhat/enterprise_linux_workstation 7.0
Published May 01, 2018
Tracked Since Feb 18, 2026