CVE 2026 59265

www.openoffice.org • October 6, 2026

A code execution issue in the Java integration in Apache OpenOffice allows a crafted untrusted document to trigger the execution of arbitrary, even remote, code when it is opened by the user.

This issue affects Apache OpenOffice: through 4.1.16.

This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase. Once 4.1.17 is released, users are recommended to upgrade to that version, which fixes the issue.

The LibreOffice suite reported this issue as CVE-2026-63277.

Thanks to the reporters for discovering this issue.

Vendor: The Apache Software Foundation

All Apache OpenOffice versions 4.1.16 and older are affected. OpenOffice.org versions may also be affected.

Until 4.1.17 is released, users can mitigate this issue by disabling the Java runtime integration: choose Tools - Options - OpenOffice - Java ( OpenOffice - Preferences - OpenOffice - Java on macOS) and untick Use a Java runtime environment . This prevents the attack. If this is not possible, or as an extra precaution, avoid opening untrusted files entirely.

Once released, install Apache OpenOffice 4.1.17 for the latest maintenance and cumulative security fixes. Use the Apache OpenOffice download page .

The Apache OpenOffice Security Team would like to thank Rick de Jager of the V12 security team, and Thomas Rinsma and Edoardo Geraci of Codean Labs, who independently discovered and reported this issue.

For additional information and assistance, consult the Apache OpenOffice Community Forums or make requests to the [email protected] public mailing list.

The latest information on Apache OpenOffice security bulletins can be found at the Bulletin Archive page.

Security -> Bulletin -> CVE-2026-59265

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RCE Vulnerability in LibreOffice and OpenOffice Spreadsheets A remote code execution vulnerability has been identified in LibreOffice and Apache OpenOffice, allowing malicious spreadsheets to execute attacker-controlled code without user consent. The flaw, tracked as CVE-2026-63277 for LibreOffice and CVE-2026-59265 for OpenOffice, exploits a feature that enables spreadsheets to link to external data sources. LibreOffice has released patches in versions 26.2.5 and 26.8.0 on October 5, 2026, while OpenOffice has not yet patched the vulnerability in its current version, 4.1.16. Users are advised to disable Java support or avoid untrusted spreadsheets until a fix is available. The vulnerability has been demonstrated in proof-of-concept scenarios, but there are no confirmed reports of exploitation in the wild. The issue affects systems where Java and JDBC support are enabled, particularly on Linux desktops. The risk level for LibreOffice's CVE-2026-63277 is rated as high with a CVSS score of 8.5. 5 sources 71

Extracted Entities

CVE 2026 59265

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

CWE Weaknesses (1)

Domains (2)

Email Addresses (1)

Platforms (1)