CVE-2026-63277: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-63277 is a remote code execution vulnerability in LibreOffice Calc that allows arbitrary Java code execution when a user opens a maliciously crafted spreadsheet document. The flaw exists in the 26.2 series of LibreOffice, specifically versions 26.2 through 26.2.4 (fixed in 26.2.5). It was published on October 5, 2026, and assigned by The Document Foundation. The vulnerability carries a CVSS v3.1 score of 7.8 (High) and a CVSS v4.0 score of 8.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). LibreOffice Calc supports linking cell ranges to external data sources via embedded document links; these links can specify a Java Database Connectivity (JDBC) driver class path. Because the application did not restrict class path entries to local file URLs, a malicious document could reference a remote URL as the Java driver location, causing LibreOffice to fetch and execute arbitrary Java code from that remote source when the document is opened. In fixed versions (26.2.5+), Java class path entries are restricted to file:// URLs, preventing remote code loading. Exploitation requires user interaction (opening the document) but no privileges or authentication (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in arbitrary Java code execution with the privileges of the user who opened the malicious document, yielding high confidentiality, integrity, and availability impact on the affected system. An attacker can read sensitive files, modify data, install malware, or establish persistence — all without triggering macro security warnings, since the attack abuses a legitimate data-linking feature rather than macros. The attack is scoped to the vulnerable system (no lateral movement to subsequent systems is indicated by the CVSS scoring), but the full user-level compromise makes it a significant threat in enterprise environments where LibreOffice is widely deployed (GitHub Advisory, Red Hat Bugzilla).

No confirmed in-the-wild exploitation has been observed, and the NVD SSVC assessment lists exploitation as "none" at time of publication. A GitHub repository (HORKimhab/CVE-2026-63277) claiming to be a PoC was assessed by Feedly as a fake claim — it contains no actual exploit code, payloads, or reproduction steps. The EPSS score is approximately 0.145%, placing it in the 4th percentile for near-term exploitation likelihood. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (IDs: 362952, 363010, 365538, 366043, 366104) and Qualys (ID: 6293444) (GitHub Advisory, Red Hat Bugzilla).

1. Craft a malicious Calc document: Create a LibreOffice Calc (.ods or .xlsx) file and configure a cell range's external data source link to reference a JDBC driver. Set the Java class path entry to a remote URL (e.g., http://attacker.com/malicious-driver.jar) pointing to an attacker-controlled server hosting a malicious Java JAR file.
2. Host the malicious JAR: On the attacker-controlled server, serve a JAR file containing a JDBC driver class that executes arbitrary Java code (e.g., spawning a reverse shell, downloading a payload, or exfiltrating data) in its static initializer or constructor.
3. Deliver the document: Send the crafted document to the target via phishing email, file share, or other social engineering means. No macro warnings are triggered because the attack uses the legitimate external data source feature.
4. Trigger code execution: When the victim opens the document in a vulnerable LibreOffice 26.2.x (< 26.2.5) installation, Calc resolves the external data source link, fetches the remote JAR from the attacker's server, loads it into the JVM, and executes the embedded malicious Java code with the victim's user privileges (GitHub Advisory, Red Hat Bugzilla).

• Network: Outbound HTTP/HTTPS connections from the LibreOffice process (soffice, soffice.bin) to unexpected external hosts, particularly fetching .jar files; DNS queries for attacker-controlled domains initiated by the LibreOffice process.
• File System: Unexpected .jar files downloaded to the user's temp directory or LibreOffice profile directory; new executables, scripts, or persistence artifacts (e.g., cron jobs, startup entries) created under the user's home directory shortly after opening a Calc document.
• Process: Unusual child processes spawned by soffice or the JVM (e.g., bash, sh, cmd.exe, powershell, curl, wget, python) that are not typical for normal LibreOffice operation.
• Logs: Java runtime exceptions or class-loading events in LibreOffice logs referencing remote URLs (non-file:// paths) in class path entries; network proxy or firewall logs showing LibreOffice-associated processes making outbound connections to unfamiliar hosts.

The primary remediation is to upgrade LibreOffice to version 26.2.5 or later, which restricts Java class path entries to file:// URLs, preventing remote driver loading (GitHub Advisory). Red Hat Enterprise Linux 9 users should apply RHSA-2026:82013 (Red Hat Bugzilla). As interim workarounds: disable Java support in LibreOffice (Tools → Options → LibreOffice → Advanced → uncheck "Use a Java runtime environment"); exercise caution when opening Calc documents from untrusted or unknown sources; and consider application allowlisting policies to restrict LibreOffice's network access in sensitive environments.

The vulnerability received notable media coverage, with The Hacker News reporting on LibreOffice and OpenOffice flaws allowing malicious spreadsheets to run code without macro warnings. Heise Online published a warning about the "code smuggling" vulnerability. Security researchers on Mastodon (infosec.exchange) and Bluesky discussed the flaw, highlighting the particularly concerning aspect that exploitation bypasses macro security warnings — a defense many users rely on. The Daily Cyber Security and Beyond Machines communities flagged it as a critical RCE requiring prompt patching. The vulnerability was also included in The Hacker News weekly recap, indicating sustained community interest.