Security experts have identified vulnerabilities in LibreOffice and Apache OpenOffice that allow malicious spreadsheets to execute code without user warnings. This flaw surfaces when the programs’ Java support is activated, posing a potential risk for users.
Details of the Vulnerability
The exploit, demonstrated as a proof of concept, does not currently have any known instances of being used in real-world attacks. The vulnerability enables code to run automatically upon opening a compromised spreadsheet file, bypassing the usual macro warnings in both office suites.
LibreOffice has addressed the issue, identified as CVE-2026-63277, with updates released on October 5. Users are advised to upgrade to versions 26.2.5 or 26.8.0 to mitigate risks. Meanwhile, Apache OpenOffice, which tracks the issue as CVE-2026-59265, has not yet issued a complete fix. The vulnerability affects all versions up to 4.1.16, with a patch expected in version 4.1.17, currently under testing.
Technical Insight into the Exploit
The exploit leverages standard features of both LibreOffice and Apache OpenOffice. It involves a ‘database range’ in a spreadsheet that refreshes data from an external source, potentially a malicious database file (ODB) specified by a web address. This file can indicate a Java database driver (JDBC driver) and its location, enabling the download and execution of attacker-controlled code.
Although these features individually function as designed, their combination results in the execution of code without user consent. The proof of concept demonstrated the execution of benign code, but the same method could execute harmful Java code of the attacker’s choice.
Mitigation and Future Outlook
Until Apache OpenOffice releases a permanent fix, users are advised to disable Java support within the application or avoid opening untrusted spreadsheets. LibreOffice users should ensure their software is updated to the latest secure versions.
The vulnerabilities were independently reported by security researchers from the V12 security team and Codean Labs, with contributions to the LibreOffice fix by Caolán McNamara of Collabora Productivity. Both The Document Foundation and Apache have been contacted for further comments on the issue.
As these office applications are widely used across various operating systems, users are encouraged to stay vigilant and apply necessary updates to safeguard their systems against potential attacks.
