CVE-2026-63267: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-63267 is an information disclosure vulnerability in LibreOffice Calc that allows automatic fetching of external CSV data links when a document is opened, without user consent or control. This behavior can expose local files to the spreadsheet or trigger unauthorized network requests to attacker-controlled hosts. The vulnerability affects LibreOffice versions in the 26.2 series prior to 26.2.5, developed by The Document Foundation. It was published on October 5, 2026, with a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.7 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is that LibreOffice Calc automatically fetches external CSV data source links embedded in a spreadsheet document at load time, bypassing the link update controls applied to other link types (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor; CWE-918: Server-Side Request Forgery; CWE-73: External Control of File Name or Path). An attacker crafts a malicious .ods or compatible spreadsheet file containing a cell range linked to either a local file path (e.g., file:///etc/passwd) or a remote attacker-controlled URL. When a victim opens the document, LibreOffice automatically resolves the link and loads the content into the sheet without prompting the user. The attack vector is local (the file must be delivered to and opened by the victim), requires no privileges, but does require user interaction (opening the file) (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a high confidentiality impact: an attacker can read arbitrary local files accessible to the victim user by embedding a file:// URI as the CSV data source, effectively exfiltrating sensitive data such as credentials, configuration files, or private documents into the spreadsheet. Additionally, the vulnerability enables SSRF-style outbound HTTP requests to attacker-controlled servers, which can be used for network reconnaissance, data exfiltration, or to probe internal services. There is no integrity or availability impact, and the scope is unchanged — exploitation is limited to the context of the victim's user account (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The CVE status is listed as "Deferred" and the NVD SSVC assessment confirms exploitation is "none" at this time. The EPSS score is approximately 0.112% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious document: Create a LibreOffice Calc spreadsheet (e.g., .ods format) and insert a cell range linked to an external CSV data source. Set the data source URL to a local file path (e.g., file:///etc/passwd on Linux or file:///C:/Windows/win.ini on Windows) or to an attacker-controlled HTTP server (e.g., http://attacker.example.com/collect).
2. Embed the link in the document: Save the document so that the external data link is persisted in the file's XML structure (typically in content.xml within the ODS archive).
3. Deliver the document to the victim: Use social engineering, phishing email, or file-sharing platforms to convince the target user to open the malicious spreadsheet.
4. Trigger automatic fetch: When the victim opens the document in a vulnerable version of LibreOffice Calc (26.2.x prior to 26.2.5), the application automatically fetches the linked CSV source without prompting the user.
5. Exfiltrate data: If a local file path was used, its contents are loaded into the spreadsheet cells and may be visible to the attacker if the document is later shared or if the attacker controls the rendering environment. If an HTTP URL was used, the victim's machine sends a request to the attacker's server, potentially leaking the file contents or internal network information in the request body or headers (GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from a workstation to unknown external hosts originating from the LibreOffice process (soffice, soffice.bin) shortly after a spreadsheet is opened; requests to attacker-controlled domains carrying CSV-formatted data in the response.
• File System: Presence of recently opened .ods, .xlsx, or .csv files from untrusted or external sources in user download or temp directories; LibreOffice lock files (.~lock.*) associated with suspicious documents.
• Logs: Network proxy or firewall logs showing outbound connections to unusual hosts from endpoints running LibreOffice, particularly to non-standard ports or IP addresses not associated with normal business traffic; DNS queries for attacker-controlled domains initiated by the LibreOffice process.
• Process: LibreOffice (soffice.bin) spawning network connections to external IPs immediately upon document open, observable via endpoint detection tools or process network monitoring.

Users should update LibreOffice to version 26.2.5 or later, in which external CSV data links are subject to the same link update controls as other spreadsheet links, requiring explicit user approval before fetching (GitHub Advisory, LibreOffice Advisory). As a workaround prior to patching, users should avoid opening LibreOffice Calc documents from untrusted or unknown sources. Organizations can also configure network egress filtering to block unexpected outbound connections from office productivity applications, and consider disabling automatic link updates in LibreOffice settings (Tools > Options > LibreOffice Calc > General > Update links when opening).

Heise Online reported on the vulnerability in the context of broader LibreOffice and OpenOffice security updates, noting warnings about code-smuggling vulnerabilities (Heise). Security aggregators including SecurityOnline.info and BeyondMachines covered the disclosure, with BeyondMachines framing it alongside other LibreOffice/OpenOffice remote code execution patches. Community reaction has been moderate, with no significant controversy; the fix is considered straightforward — aligning external CSV link behavior with existing link update controls.