Researchers have disclosed vulnerabilities in LibreOffice and Apache OpenOffice that let a malicious spreadsheet run code on a victim's computer without triggering the macro security warning, The Hacker News reported Tuesday. LibreOffice released fixes Monday; OpenOffice has not yet shipped a patched version.

What Happened

The LibreOffice flaw is tracked as CVE-2026-63277 and the OpenOffice flaw as CVE-2026-59265. LibreOffice versions before 26.2.5 and 26.8.0 are affected, and both of those releases, published Oct. 5, contain the fix. All Apache OpenOffice versions up to and including 4.1.16 are affected. A fix is planned for OpenOffice 4.1.17, which is still being tested.

No single feature is broken on its own. The attack chains three legitimate capabilities. A spreadsheet can define a database range, a block of cells that refreshes automatically from an external data source. That source can be an ODB database file fetched from a web address the attacker controls. And an ODB file can specify a JDBC driver, the Java component used to connect to databases, which the suite downloads and loads. Because the driver runs as Java code inside the office application, the attacker gets code execution without the user ever being asked whether to trust the document.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The attack works only when Java support is enabled in the application.

The issues were found by Rick de Jager of V12 Security and by Thomas Rinsma and Edoardo Geraci of Codean Labs, which reported the OpenOffice flaw. The LibreOffice fix was written by Caolán McNamara of Collabora Productivity. V12 has published a proof of concept that works against both suites; it opens the calculator app as a harmless stand-in for arbitrary code. No attacks using the technique have been reported.

Why It Matters

Office suites depend heavily on macro warnings to protect users from booby-trapped documents. Users and security teams are trained to treat a macro prompt as the danger signal, and many organizations block macros in files from outside sources. A document that reaches code execution through data-connection features skips that checkpoint entirely, so a spreadsheet that opens without any warning offers little reassurance.

The combination of a public proof of concept and an unpatched OpenOffice raises the risk that the method will be picked up for phishing, where attackers send spreadsheet attachments disguised as invoices or reports. LibreOffice is widely used by government agencies and businesses as an alternative to Microsoft Office, which broadens the set of potential targets for organizations slow to update.

How to Protect Systems

LibreOffice users should update to 26.2.5 or 26.8.0. Organizations that manage LibreOffice centrally will need to push those versions to endpoints, since older builds remain vulnerable regardless of macro settings.

For OpenOffice, which has no fix yet, the researchers recommend disabling Java in the application's settings and not opening spreadsheets from untrusted sources. Disabling Java also cuts off the attack in unpatched LibreOffice installations, though updating is the more complete fix.

What to Watch

The main open item is the release date for OpenOffice 4.1.17. Security teams should also watch for any reports of the technique being used in the wild now that working exploit code is public, and for whether other office software that supports external data sources and Java database drivers turns out to have similar paths around its trust prompts.