LibreOffice and OpenOffice flaws enable code execution via spreadsheets

Affected Systems

LibreOffice versions before 26.2.5 and 26.8.0 (CVE-2026-63277, patched). Apache OpenOffice all versions up to and including 4.1.16 (CVE-2026-59265, unpatched). Attack requires Java support enabled in application settings.

Exploitation Status

Proof of concept demonstrated by V12 security team and Codean Labs. No active exploitation reported in the wild. Attack chains database range auto-refresh with remote JDBC driver loading to bypass macro warnings.

Business Impact

Malicious spreadsheets can execute arbitrary code on open without user consent when Java is enabled. Bypasses standard macro security warnings. Works cross-platform (Windows, Linux). OpenOffice users remain vulnerable until version 4.1.17 releases. Organizations using OpenOffice with Java enabled face immediate risk from weaponized spreadsheet attachments.

Urgency

🟠 Within 24 hours

Recommended Actions

• Update LibreOffice to version 26.2.5 or 26.8.0 immediately via official channels
• Disable Java support in Apache OpenOffice (Tools > Options > Advanced) until version 4.1.17 is available
• Block or sandbox untrusted .ods and .odb files at email gateway and web proxy
• Monitor for unexpected outbound connections from LibreOffice/OpenOffice processes to external servers
• Consider migrating from Apache OpenOffice to actively maintained alternatives given delayed patch timeline