Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected versions LibreOffice supports hyperlinks with macro or similar built-in command targets that can be executed when activated without warning the user.

This issue requires that a user actively opens a specially crafted document and clicks on a malicious hyperlink within LibreOffice. The full upstream fix requires extensive changes across multiple core subsystems that cannot be safely backported to the version shipped in Amazon Linux 2 (5.3.6.1) due to the large version gap (~4 major releases). No fix is planned for Amazon Linux at this time.