TI-2026-67606 Aliases CVE-2026-63267 GHSA-2r33-w77m-6p5h

Local file read and SSRF in LibreOffice Calc external data links

LOW 28CWE-200Published 2026-10-05 · Updated 2026-10-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

LibreOffice from 26.2 before 26.2.5 fetches external csv data links saved in Calc documents when the document loads. A flaw in this handling lets a crafted document read a local file into a sheet or make a request to a host of its choosing (CWE-918). An attacker with low local privileges needs a user to open the crafted document.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00112 1st percentileScored 2026-11-07

Fix Partial LibreOffice (The Document Foundation): < 26.2.5Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The Document Foundation	LibreOffice	26.2 to before < 26.2.5	< 26.2.5	Patch available	CNA

LibreOffice VendorThe Document Foundation Affected 26.2 to before < 26.2.5 Fixed in < 26.2.5 Patch available CNA

Remediation

Upgrade LibreOffice to the fixed version listed as < 26.2.5. Red Hat Enterprise Linux 6, 7, 8 and 9 are listed as affected, with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA LibreOffice (The Document Foundation) Fixed in < 26.2.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-05
The Document Foundation LibreOffice < 26.2.5
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-67610 Remote code execution in LibreOffice Calc via external data linksPriority LOW 39
- TI-2026-67605 Arbitrary file write via LibreOffice Calc data mappingsPriority LOW 29
- TI-2026-67609 Environment and INI file values leak through LibreOffice documentsPriority LOW 28
Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-05 Threatist record created from CVE-2026-63267
2026-10-05 Alias added: GHSA-2r33-w77m-6p5h
2026-10-06 Affected versions changed · Red Hat
2026-10-06 CVSS score added · Red Hat

References

Other 1

https://www.libreoffice.org/about-us/security/advisories/cve-2026-63267

TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5

See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences