A highly critical security vulnerability exists in the LibreOffice and OpenOffice office software packages, through which attackers can inject malicious code with manipulated documents. LibreOffice is also closing further security vulnerabilities.
The LibreOffice project publishes a list of security vulnerabilities closed with the current software versions. The most serious is a vulnerability in the Calc spreadsheet. Calc documents can link a cell range with external data sources, and the link ends up in the document. The document can also specify a Java database driver with an external source, which should be used to open this link. When opening such a document, Java code from this external source is executed. The fix provides that such a Java classpath must be a file URL ( CVE-2026-63277 , CVSS4 8.5 , Risk “ high ”).
The same vulnerability also affects Apache OpenOffice version 4.1.16 and older, but it has received another CVE number for it ( CVE-2026-59265 , without its own CVSS rating, but Apache classifies it as “ critical ”). The Apache developers write that temporarily disabling Java runtime integration until the update is installed will cause attacks to fail; LibreOffice, on the other hand, does not provide a workaround.
The further vulnerabilities were only reported by LibreOffice; they narrowly miss classification as high risk and are therefore considered medium risk:
Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality ( CVE-2026-63266 , CVSS4 6.8 , Risk “ medium ”)
LFI and GET SSRF via calcext:data-mappings and csv provider ( CVE-2026-63267 , CVSS4 6.7 , Risk “ medium ”)
LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href ( CVE-2026-63268 , CVSS4 6.7 , Risk “ medium ”)
LFI and GET SSRF via GStreamer and HLS playlists ( CVE-2026-63269 , CVSS4 6.7 , Risk “ medium ”)
Environment/ini-file leaks ( CVE-2026-63270 , CVSS4 6.7 , Risk “ medium ”).
LibreOffice states that versions 26.2.5 and 26.8.0 fix the vulnerabilities. Version 26.2.5 has been available for download since July 23rd of this year, but version 26.2.6 from September 24th, 2026 is now current in that development branch. Version 26.8.0 was released on August 26th. Those who have not yet installed the latest versions should do so now to minimize the attack surface.
Apache states that the bug fix will come with OpenOffice 4.1.17. The version is in the release candidate phase; as soon as it is available, the Apache Software Foundation recommends upgrading to it. However, since OpenOffice is only maintained in a very rudimentary way, switching to LibreOffice is recommended to receive security updates early.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
