CVE-2026-63268: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-63268 is an information disclosure vulnerability in LibreOffice Calc that allows a malicious document to read arbitrary local text files into a spreadsheet when opened by a victim. The flaw exists in the 26.2 series of LibreOffice prior to version 26.2.5, developed by The Document Foundation. It was published on October 5, 2026, with a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.7 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper restriction of external data source link types in LibreOffice Calc (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor; CWE-73: External Control of File Name or Path). LibreOffice Calc supports linking cell ranges to external data sources, and these links are persisted in the document file. A sql-type data source link can reference a local directory of text files as a database, causing LibreOffice to automatically read those files into the spreadsheet upon document load — without explicit user approval beyond opening the file. The fix restricts automatic restoration of external data links on document load to only the csv, html, and xml provider types, blocking the sql provider from being restored (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in unauthorized disclosure of local text file contents from the victim's system — including potentially sensitive files such as configuration files, credentials, SSH keys, or other plaintext data accessible to the user running LibreOffice. There is no integrity or availability impact; the attack is limited to confidentiality. The scope is confined to the local system, but the exfiltrated data could facilitate further attacks or lateral movement if sensitive credentials are exposed (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.119% (2nd percentile), indicating a low near-term exploitation probability. Exploitation requires user interaction — specifically, a victim must open a specially crafted LibreOffice Calc document — making mass exploitation less likely but targeted social engineering attacks feasible.

1. Craft a malicious document: Create a LibreOffice Calc document (.ods or .xlsx) that embeds an external data source link of the sql type, pointing to a local directory containing target text files (e.g., /home/victim/.ssh/ or /etc/) as a pseudo-database.
2. Identify target files: Determine which local text files are of interest (e.g., id_rsa, passwd, application config files) and ensure the sql data source link references the appropriate directory path.
3. Deliver the document: Send the malicious document to the target via phishing email, file sharing, or other social engineering means, enticing the victim to open it.
4. Trigger automatic data load: When the victim opens the document in a vulnerable version of LibreOffice Calc (26.2 series prior to 26.2.5), the sql-type external data link is automatically restored and the referenced local text file is read into the spreadsheet cells.
5. Exfiltrate data: If the document is configured to send data externally (e.g., via a macro or a secondary external link to an attacker-controlled server), the file contents are transmitted; alternatively, the attacker may rely on the victim saving and returning the document, or use other means to retrieve the populated spreadsheet (GitHub Advisory, Red Hat Bugzilla).

• File System: Unexpected or recently modified LibreOffice Calc documents (.ods, .xlsx) containing embedded sql-type external data source definitions in their XML content (look for <db:data-source> or similar tags referencing local filesystem paths).
• Logs: LibreOffice application logs showing external data source connections to local directories upon document open; audit logs recording file read access to sensitive directories (e.g., /etc/, ~/.ssh/) by the soffice process.
• Process: The soffice or soffice.bin process accessing files outside of normal document directories, particularly reading from sensitive system or user directories shortly after a Calc document is opened.
• Network: Outbound network connections from the LibreOffice process to unexpected external hosts shortly after opening a Calc document (may indicate a secondary exfiltration mechanism embedded in the document).

Update LibreOffice to version 26.2.5 or later, which restricts automatic restoration of external data source links to only the csv, html, and xml provider types, blocking the vulnerable sql provider (GitHub Advisory). As a workaround for users who cannot immediately update, avoid opening LibreOffice Calc documents from untrusted or unknown sources. Additionally, consider disabling external data links in LibreOffice security settings (Tools > Options > LibreOffice Calc > Formula > External Links) if this functionality is not required in your environment.

Heise Online reported on the vulnerability in the context of broader LibreOffice security updates, noting warnings about code-smuggling vulnerabilities (Heise). BeyondMachines covered the LibreOffice and OpenOffice patch release addressing remote code execution and related vulnerabilities. Security aggregators such as SecurityOnline.info and VulDB indexed the advisory shortly after publication. Overall community reaction has been measured, reflecting the medium severity rating and absence of active exploitation.