LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings
LibreOffice and OpenOffice spreadsheets can execute attacker code without user warning if Java is enabled.
Security researchers have demonstrated a vulnerability in LibreOffice and Apache OpenOffice that allows malicious spreadsheets to execute arbitrary attacker code without any user warning, provided Java support is enabled. LibreOffice has released a fix, tracked as CVE-2026-63277, while Apache OpenOffice, affected by CVE-2026-59265, expects a fix in a future release. The attack leverages the 'database range' feature to pull in and execute code from a remote ODB file, bypassing macro security prompts.
AI summary of the linked source. Not reviewed by an editor. How this works
Run LibreOffice?
Get an email when a new story names LibreOffice, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical vulnerability in LibreOffice and Apache OpenOffice allows attackers to execute arbitrary code through maliciously crafted spreadsheets by abusing the 'database range' feature to load and run code from remote ODB files — all without triggering macro security warnings. The root problem lies in insufficient input validation and a failure to apply macro security controls consistently across all code execution pathways, not just traditional macros. LibreOffice has issued a patch (CVE-2026-63277), but Apache OpenOffice has no fix available yet, leaving a large portion of the user base exposed. This matters because office productivity suites are ubiquitous in enterprise environments, and silent code execution bypassing security prompts dramatically lowers the bar for successful phishing and document-based attacks.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-63277
- cve — CVE-2026-59265