LibreOffice shipped a fix on October 5, 2026 for a flaw where opening a crafted spreadsheet could run an attacker's Java code. Apache OpenOffice has the matching flaw and has not shipped a fix yet.
LibreOffice (security page, announced Oct 5, 2026):
- The issue is tracked as CVE-2026-63277, "RCE via calcext:data-mappings, sql provider and jdbc connector."
- LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver to be loaded from a remote location, so opening the document could run Java code from that location.
- Fixed in LibreOffice 26.2.5 and 26.8.0. All users are recommended to upgrade to 26.2.5 or later, or 26.8.0 or later.
- The page credits Thomas Rinsma and Edoardo Geraci of Codean Labs for reporting it, and Caolan McNamara of Collabora Productivity for the fix. The same release also fixed other issues, including CVE-2026-63269 and CVE-2026-63270, which are separate entries on that page.
Apache OpenOffice (advisory posted to oss-security on October 2, 2026):
- The issue is CVE-2026-59265, rated critical by Apache. A code execution issue in the Java integration in OpenOffice 4.1.16 and earlier lets a crafted untrusted document trigger executing arbitrary, even remote, code when opened.
- The fix is expected in version 4.1.17, which is in the release candidate phase.
- Until then, Apache says users can mitigate by disabling Java runtime integration in the Preferences dialog, which prevents the attack, or avoid opening untrusted files.
- Credit goes to Thomas Rinsma and Edoardo Geraci of Codean Labs and to Rick de Jager.
What The Hacker News adds:
- It reports the attack opens no warning of the kind the programs show before running a macro, and works only when Java support is enabled.
- It says the V12 security team published a proof of concept, that the researchers tested it on Windows and Linux, and that there are no reports of use in real attacks.
- It describes the chain as normal features combined: a spreadsheet's refreshing "database range" pulls a database file from a web address, the file names a JDBC driver, and the driver's code is fetched from a remote server.
What we could not confirm: the Java-must-be-enabled condition, the macro-warning comparison, the proof-of-concept details and the no-known-attacks statement are from The Hacker News and were not in the vendor pages we read. We did not test the flaw.
Sources: LibreOffice's security advisories page, Apache OpenOffice's CVE-2026-59265 advisory on oss-security, and The Hacker News report of October 6, 2026.