A flaw in LibreOffice and OpenOffice lets a spreadsheet run code when opened, with no macro warning

What happened

On 5 October 2026, LibreOffice released versions 26.2.5 and 26.8.0 with the fix for vulnerability CVE-2026-63277. According to its security advisory, LibreOffice Calc can link a cell range to an external data source, and that link is saved in the document. A tampered document could specify that the database driver be loaded from a remote location, so that opening the file ran Java code from that location.

Three days earlier, on 2 October, the Apache OpenOffice project had published an advisory on an equivalent flaw, CVE-2026-59265, which it rates as critical: an untrusted document "can execute arbitrary code" when opened. It affects all versions up to 4.1.16, the latest released.

The flaws were discovered independently by Rick de Jager, of the V12 team, and by Thomas Rinsma and Edoardo Geraci, of Codean Labs, according to both projects' advisories.

What we know

• LibreOffice: the flaw is fixed in versions 26.2.5 and 26.8.0. LibreOffice recommends updating to one of them or a later one.
• Apache OpenOffice: there is no fix yet. The advisory says it will come with version 4.1.17, which is in testing. Until then, it recommends disabling Java integration in the program's preferences, which prevents the attack, and, as an extra precaution, not opening files from untrusted sources.
• No macro warning: according to The Hacker News, the attack chains normal features of the program and doesn't show the security warning that appears when opening a document with macros. It only works if Java support is enabled.
• No known attacks: The Hacker News says it has only been shown as a proof of concept and there are no reports of use in real attacks. The researchers have published that proof of concept.

What we don't know yet

• When OpenOffice 4.1.17 will be released. As of 13 October, the Apache OpenOffice downloads page still offers 4.1.16 as the current version.
• Whether anyone is already exploiting it. No attacks have been confirmed, but the technical details and the proof of concept have been public for a week.

Why it matters

Many companies have learned to distrust documents that ask to "enable macros". This flaw gets around that barrier: the file doesn't ask for anything, simply opening it is enough.

What's more, the spreadsheet is one of the most common attachments in a company's day-to-day work: quotes, lists, reconciliations, orders. It's exactly the kind of file people open without thinking.

What it means for an SME

LibreOffice and OpenOffice are free, which is why they are often found in small companies, accountancy firms and professional offices, sometimes installed years ago on some computers and not on others. In practice:

• nobody knows for sure which computers they're installed on or in which version;
• OpenOffice may still be on old computers even if the company now works with another suite;
• whoever opens the spreadsheet sent by a "supplier" has no way of seeing that something is wrong.

The good news is that the solution is simple and doesn't require technical knowledge: update, or turn off an option.

What your company should do this week

1. Find out which computers have LibreOffice or OpenOffice. If you have an IT provider, ask them for the list with each computer's version.
2. Update LibreOffice to version 26.2.5 or 26.8.0, or a later one. You can check it in the Help › About LibreOffice menu.
3. If you use Apache OpenOffice, disable Java in the program's options, as the project itself recommends, until version 4.1.17 is released. Also consider whether it's worth moving to LibreOffice, which does have a patch.
4. Remind your team not to open spreadsheets they weren't expecting, even if they seem to come from a customer or supplier, and to check through another channel if in doubt. Our guide to spotting phishing in accountancy firms (in Spanish) gives tips that work for any office.