CVE-2026-63277

CVE Enrichment

CVSS: 8.5 HIGH
EPSS: 0.15%
EPSS Percentile: 3.27%
CISA KEV: Not listed

Description

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: security@documentfoundation.org
Published: 05-Oct-2026 19:17
Last Modified: 06-Oct-2026 22:03
EPSS Date: 2026-10-10
CWE: CWE-829

CVSS Vector


            CVSS:4.0                            AV:L /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:P /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

security@documentfoundation.org

Last enrichment sync: 11-Oct-2026 16:12
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

plugin), CVE-2026-105133, CVE-2026-105134 (AhsayCBS), CVE-2026-96940 (Microsoft Exchange Server), CVE-2026-63277 (LibreOffice), CVE-2026-59265 (Apache OpenOffice), and multiple vulnerabilities in WordPress. Weekly Cybersecurity Recap Highlights Exploited Atlassian Flaw and Other Threats
LibreOffice has already fixed the flaw, which it tracks as CVE-2026-63277, in updates released on October 5. It recommends that users move to version 26.2.5 or 26.8.0. Versions before those are affected. LibreOffice and OpenOffice Flaws Let Spreadsheets Run Code Without Macro Warnings

CVE (52)

People (4)

MITRE ATT&CK (1)

Vendors (1)

Products (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.