LibreOffice and OpenOffice Flaws Let Spreadsheets Run Code Without Macro Warnings
Summary
Researchers demonstrated that malicious spreadsheets can run attacker-controlled Java code in LibreOffice and OpenOffice without a macro warning when Java support is enabled. LibreOffice has patched its flaw; OpenOffice's remains unfixed.
Key points
- The vulnerabilities can trigger code execution when a spreadsheet is opened, without the programs' usual macro trust warning.
- The attack requires Java support to be enabled and was demonstrated as a proof of concept; no real-world use has been reported.
- LibreOffice CVE-2026-63277 affects versions before 26.2.5 or 26.8.0; fixes were released October 5.
- Apache OpenOffice CVE-2026-59265 affects versions through 4.1.16. A fix is expected in 4.1.17, which is still being tested.
- OpenOffice users can mitigate the issue by disabling Java or avoiding untrusted spreadsheets.
- The attack uses a spreadsheet database range to retrieve an ODB file, which can direct the program to download and run a Java driver.
Article Details
- Vulnerability Types
- Arbitrary Java code execution
- Affected Versions
- LibreOffice versions before 26.2.5 or 26.8.0
- Apache OpenOffice versions up to and including 4.1.16
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Disable Java in Apache OpenOffice settings.
- Do not open untrusted spreadsheets.
MITRE ATT&CK
CVE
CVE-2026-59265Apache OpenOffice has not fixed the matching flaw, which it tracks as CVE-2026-59265. Every version up to and including its current release, 4.1.16, is affected, and the project says a fix is expected in version 4.1.17,CVE-2026-63277LibreOffice has already fixed the flaw, which it tracks as CVE-2026-63277, in updates released on October 5. It recommends that users move to version 26.2.5 or 26.8.0. Versions before those are affected.
People
Caolán McNamaraWrote the fix for LibreOffice.Edoardo GeraciIndependently reported the LibreOffice flaw on behalf of Codean Labs.Rick de JagerIndependently reported the LibreOffice flaw on behalf of the V12 security team.Thomas RinsmaIndependently reported the LibreOffice flaw on behalf of Codean Labs.
Products
Apache OpenOfficeA malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program showsLibreOfficeA malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows