Libre Office and Open Office Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings
Summary: Researchers showed that a malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, with no macro-style warning, when Java support is enabled. LibreOffice fixed the flaw, tracked as CVE-2026-63277, in updates released October 5 and recommends version 26.2.5 or 26.8.0, while Apache OpenOffice has not fixed the matching flaw, CVE-2026-59265, which affects every version up to and including 4.1.16, with a fix expected in 4.1.17.
What's compelling: The attack chains ordinary features - a self-refreshing database range, an ODB fetched from a web address, and a JDBC driver pulled as a JAR - so it reaches code execution without ever asking the user to trust the document. Apache OpenOffice users have no patch yet and must turn off Java or avoid untrusted spreadsheets until 4.1.17 ships.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-59265CVE-2026-63277
- Related
- ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, Shiny Hunters Arrest, AI-Fooling Malware and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026