CVE-2026-63270: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-63270 is an information disclosure vulnerability in LibreOffice that allows specially crafted documents to exfiltrate environment variables and INI file values to a remote server when opened by a user. It is a bypass of the incomplete fix introduced for CVE-2024-12426, as XForms instance data and the Calc CSV and SQL data providers were not covered by the prior check. Affected versions are LibreOffice 26.2 series prior to 26.2.5, developed by The Document Foundation. The vulnerability was published on October 5, 2026, with a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.7 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper filtering of document-supplied URLs that reference internal schemes (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor; CWE-201: Insertion of Sensitive Information Into Sent Data). When a LibreOffice document contains URLs crafted to include environment variable or INI file expansion syntax, the application resolves these values and may transmit them to an attacker-controlled remote server. The prior fix for CVE-2024-12426 did not account for all URL ingestion paths — specifically XForms instance data and the Calc CSV and SQL data providers — leaving those vectors unprotected. In fixed versions, these code paths refuse URLs with internal schemes when the URL originates from document content (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a high confidentiality impact: sensitive data such as environment variables (which may contain credentials, API keys, or system paths) and INI file values can be silently exfiltrated to an attacker-controlled server when a victim opens a malicious document. There is no integrity or availability impact. The attack is local in vector but can be delivered remotely via a malicious document distributed over email or the web, requiring only passive user interaction (opening the file) (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable. The EPSS score is approximately 0.116%, placing it in the 1st percentile for exploitation likelihood within 30 days. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. A patch is available in LibreOffice 26.2.5.

1. Craft a malicious document: Create a LibreOffice document (e.g., an ODS spreadsheet or an XForms-based document) that embeds URLs referencing internal expansion syntax for environment variables (e.g., file://$HOME/.config/someapp/config.ini) or INI file values via the Calc CSV/SQL data provider or XForms instance data fields.
2. Deliver the document: Distribute the crafted document to a target user via email attachment, file share, or web download, relying on social engineering to prompt the user to open it.
3. Trigger URL expansion: When the victim opens the document in a vulnerable LibreOffice 26.2.x version (prior to 26.2.5), the application processes the embedded URLs, expanding environment variable or INI file references without sanitization.
4. Exfiltrate data: The expanded URL — now containing the resolved sensitive values — is fetched by LibreOffice, sending an HTTP or similar request to the attacker's remote server with the sensitive data embedded in the URL path or query string.
5. Collect exfiltrated data: The attacker monitors their server logs to capture the transmitted environment variable values or INI file contents, which may include credentials, tokens, or configuration secrets (GitHub Advisory, Red Hat Bugzilla).

• Network: Outbound HTTP/HTTPS requests from a LibreOffice process to unexpected external hosts, particularly with URL paths or query parameters containing strings resembling environment variable values, file paths, or configuration data.
• Network: DNS lookups or connections to attacker-controlled domains initiated immediately upon opening a LibreOffice document.
• Logs: System or proxy logs showing LibreOffice (e.g., soffice, soffice.bin) making outbound network connections to external IPs or domains not associated with LibreOffice update services.
• Process: LibreOffice process spawning network activity (e.g., curl, wget, or internal socket calls) triggered by document open events, particularly involving XForms or Calc CSV/SQL data sources.
• File System: Presence of recently received or downloaded LibreOffice documents (.ods, .odt, .xhtml) containing XForms instance data or Calc data provider configurations referencing external URLs.

Update LibreOffice to version 26.2.5 or later, which refuses URLs with internal schemes when the URL originates from document content (GitHub Advisory). As an interim workaround, avoid opening LibreOffice documents from untrusted or unknown sources, and consider disabling automatic document opening from email clients or browsers. Network-level controls such as egress filtering to block unexpected outbound connections from LibreOffice processes can reduce exfiltration risk until patching is complete.

Heise Online reported on the vulnerability in the context of broader LibreOffice security updates, noting warnings about code-smuggling vulnerabilities (Heise). Security aggregators including SecurityOnline.info and BeyondMachines covered the LibreOffice patch release. Community reaction has been moderate, consistent with the medium severity rating and absence of active exploitation.