LibreOffice patched spreadsheet code-execution flaw; OpenOffice fix pending

Feeds.4Sysops •IT News • October 6, 2026

A crafted spreadsheet can run Java code in LibreOffice or Apache OpenOffice without triggering a macro warning—but Java must be enabled. LibreOffice patched the flaw on October 5, while Apache OpenOffice users remain exposed pending a fix. No attacks in the wild have been reported. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RCE Vulnerability in LibreOffice and OpenOffice Spreadsheets A remote code execution vulnerability has been identified in LibreOffice and Apache OpenOffice, allowing malicious spreadsheets to execute attacker-controlled code without user consent. The flaw, tracked as CVE-2026-63277 for LibreOffice and CVE-2026-59265 for OpenOffice, exploits a feature that enables spreadsheets to link to external data sources. LibreOffice has released patches in versions 26.2.5 and 26.8.0 on October 5, 2026, while OpenOffice has not yet patched the vulnerability in its current version, 4.1.16. Users are advised to disable Java support or avoid untrusted spreadsheets until a fix is available. The vulnerability has been demonstrated in proof-of-concept scenarios, but there are no confirmed reports of exploitation in the wild. The issue affects systems where Java and JDBC support are enabled, particularly on Linux desktops. The risk level for LibreOffice's CVE-2026-63277 is rated as high with a CVSS score of 8.5. 5 sources 71

LibreOffice patched spreadsheet code-execution flaw; OpenOffice fix pending

The full story

Extracted Entities

Companies (1)

Platforms (1)