TI-2026-67607 Aliases CVE-2026-63268 GHSA-rvj5-mfwr-769g

Local file read through linked data sources in LibreOffice Calc

LOW 28CWE-200Published 2026-10-05 · Updated 2026-10-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

LibreOffice from 26.2 before 26.2.5 is affected. A data link saved in a Calc document with the sql type can name a folder of local text files as a database, so opening a crafted document reads a local text file into the sheet (CWE-200). A local attacker with low privileges needs a user to open the document to expose the file contents.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00119 1st percentileScored 2026-11-07

Fix Partial LibreOffice (The Document Foundation): < 26.2.5Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The Document Foundation	LibreOffice	26.2 to before < 26.2.5	< 26.2.5	Patch available	CNA

LibreOffice VendorThe Document Foundation Affected 26.2 to before < 26.2.5 Fixed in < 26.2.5 Patch available CNA

Remediation

Update LibreOffice to 26.2.5 or later. Red Hat lists Red Hat Enterprise Linux 6 with no fix planned and Red Hat Enterprise Linux 7, 8 and 9 with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA LibreOffice (The Document Foundation) Fixed in < 26.2.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-05
The Document Foundation LibreOffice < 26.2.5
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-67610 Remote code execution in LibreOffice Calc via external data linksPriority LOW 39
- TI-2026-67605 Arbitrary file write via LibreOffice Calc data mappingsPriority LOW 29
- TI-2026-67609 Environment and INI file values leak through LibreOffice documentsPriority LOW 28
Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-05 Threatist record created from CVE-2026-63268
2026-10-05 Alias added: GHSA-rvj5-mfwr-769g
2026-10-06 Affected versions changed · Red Hat
2026-10-06 CVSS score added · Red Hat

References

Other 1

https://www.libreoffice.org/about-us/security/advisories/cve-2026-63268

TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5

See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences