LibreOffice and OpenOffice Flaws Allow Code Execution via Malicious Spreadsheets

Vulnerability Details

Security researchers have identified flaws in LibreOffice and Apache OpenOffice that enable arbitrary code execution through specially crafted spreadsheets. The attack bypasses typical macro security warnings, allowing code to run as soon as the file is opened. This vulnerability is contingent on the office suite having Java support enabled.

Technical Mechanism

The attack exploits the 'database range' feature in Calc spreadsheets, which can pull and refresh data from external sources like ODB files. An ODB file, specified by a web address within the spreadsheet, can then reference a Java database driver (JDBC). The program downloads this driver, which can be a JAR file containing attacker-controlled code, and executes it. While each component functions as designed, their combination allows for code execution without user consent or warning.

LibreOffice Patch Status

LibreOffice has addressed its vulnerability, tracked as CVE-2026-63277, in updates released on October 5. Users are advised to upgrade to version 26.2.5 or 26.8.0 to mitigate the risk, as all prior versions are affected.

Apache OpenOffice Status and Mitigation

Apache OpenOffice has not yet released a fix for its corresponding flaw, CVE-2026-59265. All versions up to and including the current release, 4.1.16, are vulnerable. A patch is anticipated in version 4.1.17, which is currently undergoing testing. Until then, Apache OpenOffice users can disable Java support within the program's settings or avoid opening untrusted spreadsheets to prevent exploitation.

Impact and Scope

The proof of concept demonstrated the execution of the Calculator app, but the method allows for any Java code to be run. The researchers confirmed the attack works on both Windows and Linux operating systems. While no real-world attacks have been reported, the vulnerability poses a risk to users who might open malicious documents from untrusted sources.