When a spreadsheet’s data connection becomes permission to run code

A spreadsheet is supposed to help you examine information. A newly disclosed flaw in LibreOffice Calc could instead let a document cause Java code from elsewhere to run when opened. LibreOffice tracks it as CVE-2026-63277; Apache OpenOffice identifies the corresponding issue as CVE-2026-59265.

LibreOffice security advisory for CVE-2026-63277

Apache OpenOffice security advisory for CVE-2026-59265

The practical distinction is easy to miss. People have learned to be wary of a spreadsheet asking to run a macro. Here, the security problem concerns a different capability: connecting a sheet to a database. An instruction to retrieve information crossed into a decision about which software the office application would execute.

Why a sheet of numbers needs connections at all

Calc is the spreadsheet application in both office suites. Its grid can represent information held somewhere else, rather than values someone typed into each cell. LibreOffice’s documentation describes database ranges: groups of cells that can connect to an external data source. This supports useful work such as analyzing data without maintaining another manually copied version of it.

LibreOffice Calc guide: database ranges and external data

Imagine a small wholesaler whose stock figures live in a database. A buyer wants a spreadsheet showing available quantities beside next month’s order estimates. Keeping a connection to the stock system can save repetitive copying and reduce mistakes. That is a hypothetical business example, but it explains why removing every connection feature would make the application less useful.

The complication is that fetching data requires software. A database driver is an adapter that lets an application communicate with a particular kind of database. Although its job involves numbers and records, the driver itself is executable software. Agreeing to read stock quantities and agreeing to run a new adapter are therefore two different decisions.

The document was allowed to make the wrong decision

LibreOffice’s advisory describes a document-controlled data link that could select a Java database driver from a remote location. Opening the document could consequently execute code supplied there. The fixed versions restrict where this driver code can be loaded from.

LibreOffice: description and correction of the Java driver flaw

Consider the boundary in everyday terms. Asking a courier to collect a package does not authorize the sender to appoint a new employee inside your office. A data connection should bring information into the spreadsheet under the application’s rules. It should not quietly let the document’s author choose additional software to operate inside that application.

This is also why a macro policy cannot answer every document-security question. Macros are one way a document can request automated behavior. Database integration is another feature with its own implementation and checks. A protection that governs the first does not automatically govern the second. Avoiding an Enable Macros button remains sensible, but it does not replace the update or mitigation for this flaw.

The relevant Java setting belongs to the office application. Apache says disabling its Java runtime integration prevents this attack. A business should check the application’s actual configuration rather than assume that a computer with Java installed is necessarily exposed, or that the absence of a familiar warning establishes safety.

Apache OpenOffice: Java integration mitigation

October’s disclosure is not October’s patch release

LibreOffice announced the security issue on October 5, 2026, identifying 26.2.5 and 26.8.0 as fixed releases. Those version numbers are the important starting point for checking an installation.

LibreOffice: October 5 advisory and fixed versions

The release chronology is older. The Document Foundation’s July 24 blog post says LibreOffice 26.2.5 was released on July 23. Its announcement archive records the 26.8 announcement on August 26. October brought public security information about fixes already distributed, rather than the first availability of both versions.

The Document Foundation: LibreOffice 26.2.5 release announcement

The Document Foundation: dated release announcement archive

For someone managing office computers, this changes the question from whether an October update was installed to which build each machine actually runs. A laptop updated during the summer may already contain the correction. An older secondary installation may still need attention even if another copy on the same computer is current.

The two products need different responses

LibreOffice: releases containing the correction

Apache OpenOffice: affected releases and pending fix

Apache’s October 2 disclosure recommends turning off Java integration while the fixed release is pending, and avoiding untrusted files when that is not possible or as an additional precaution. A release candidate is still undergoing release testing; its existence should not be reported as a completed production release.

Apache’s October 2 disclosure to oss-security

Before changing the setting across a business, identify any legitimate workflow that depends on it. The wholesaler’s buyer may need help obtaining the same figures through an approved alternative while IT resolves that dependency. A workaround people cannot do their jobs around invites them to reverse it. Record the temporary arrangement and who will verify the eventual update.

Check the program that actually opens the file, too. Similar product names and familiar icons can conceal different installed applications. Giving every employee the same version instruction would be misleading here: LibreOffice’s fixed build numbers do not apply to Apache OpenOffice.

A confirmed flaw is not a confirmed attack on your business

The vendor advisories confirm the vulnerabilities and the available response. They do not identify an observed campaign against users. Public disclosure establishes a reason to act without establishing that a particular spreadsheet was malicious or that a particular computer was compromised.

If an unexpected document was already opened on an affected installation, retain the message and file without reopening them and give IT the approximate time and application version. Those details provide a starting point for assessment. A normal-looking sheet is not proof of safety, but the mere presence of an older version is not proof of data theft either.

Both vendors credit independent reports from Rick de Jager of V12 and Thomas Rinsma and Edoardo Geraci of Codean Labs. LibreOffice credits Caolán McNamara of Collabora Productivity with its fix.

LibreOffice: researcher and fix acknowledgements

Apache OpenOffice: independent researcher acknowledgements

Source check: October 8, 2026. This is ShortCircuit’s analysis of vendor advisories and release records. The wholesaler example is hypothetical. Release status and vendor advice reflect the primary sources checked on that date; no in-the-wild campaign is established by those advisories.