[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9xqKOb-Ns76i_N5SB2M6_WFSCQmNsUDlH4wzrI0CL-A":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":57},"cc77957c-5ab8-4e6c-95a7-805f7cdb7927","malicious-spreadsheets-exploit-libreoffice-openoffice-to-run-code-silently","a7504786-7305-40a6-9310-0714830db205","Malicious Spreadsheets Exploit LibreOffice & OpenOffice to Run Code Silently","A critical vulnerability in LibreOffice and Apache OpenOffice allows attackers to execute arbitrary code through maliciously crafted spreadsheets by abusing the 'database range' feature to load and run code from remote ODB files — all without triggering macro security warnings. The root problem lies in insufficient input validation and a failure to apply macro security controls consistently across all code execution pathways, not just traditional macros. LibreOffice has issued a patch (CVE-2026-63277), but Apache OpenOffice has no fix available yet, leaving a large portion of the user base exposed. This matters because office productivity suites are ubiquitous in enterprise environments, and silent code execution bypassing security prompts dramatically lowers the bar for successful phishing and document-based attacks.","**Immediate actions:**\n- Apply LibreOffice's patch for CVE-2026-63277 immediately and monitor Apache OpenOffice advisories for CVE-2026-59265 remediation.\n- Disable Java support in LibreOffice and OpenOffice settings on all endpoints where Java functionality is not explicitly required.\n- Block or restrict outbound connections from office suite processes to external\u002Funtrusted network resources via firewall or endpoint policy.\n\n**Configuration hardening:**\n- Set macro security to the highest level in LibreOffice\u002FOpenOffice and enforce this via group policy or configuration management tools.\n- Prevent users from opening spreadsheets or office documents received from untrusted or external sources without sandboxed preview.\n- Audit and restrict which applications are permitted to initiate outbound network connections using application-layer controls.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) rules to alert on office suite processes spawning unexpected child processes or making external network calls.\n- Monitor DNS and proxy logs for unusual outbound requests originating from LibreOffice or OpenOffice processes.\n- Establish a vulnerability management cadence that flags unpatched open-source productivity software as a high-priority risk item.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST CSF ID.VM-1: Vulnerabilities are identified and documented","MITRE ATT&CK T1204.002: User Execution – Malicious File","MITRE ATT&CK T1059: Command and Scripting Interpreter",{},"published","2026-10-06T12:20:27.416657+00:00","2026-10-06T12:20:27.3+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flibreoffice-and-openoffice-flaws-let.html","libreoffice-and-openoffice-flaws-let-malicious-spreadsheets-run-code-without-mac-0d2a51","LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":45,"name":46,"slug":47,"description":48,"color":49},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[51],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"ec5dffc4-3f53-4908-a7f1-a2858a6ab814","2026-10-06","afternoon","ThreatNoir Afternoon Brief — October 6","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-06\u002Fthreatnoir-afternoon-brief-2026-10-06.mp3",[58,61,65],{"slug":47,"name":59,"problem":60},"Automated patch management","Known holes get closed in days, not months.",{"slug":62,"name":63,"problem":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":66,"name":67,"problem":68},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]