TI-2026-67610 Aliases CVE-2026-63277 GHSA-5jx8-5g92-5w59

Remote code execution in LibreOffice Calc via external data links

LOW 39CWE-829Published 2026-10-05 · Updated 2026-10-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-829.

Summary

LibreOffice from 26.2 before 26.2.5 is affected. Calc links cell ranges to external data sources saved in the document, and a document can name a Java database driver that is loaded from a remote location (CWE-829). If a user opens a crafted document, an attacker can run Java code from that location.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0034 27th percentileScored 2026-11-07

Fix Partial LibreOffice (The Document Foundation): < 26.2.5Red Hat: 2 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The Document Foundation	LibreOffice	26.2 to before < 26.2.5	< 26.2.5	Patch available	CNA

LibreOffice VendorThe Document Foundation Affected 26.2 to before < 26.2.5 Fixed in < 26.2.5 Patch available CNA

Remediation

Upgrade LibreOffice to 26.2.5 or later. Red Hat fixes this in RHSA-2026:82013 for Red Hat Enterprise Linux AppStream (version 9) and CodeReady Linux Builder (version 9), and in RHSA-2026:88164 for AppStream (version 8) and CRB (version 8). Red Hat Enterprise Linux 7 is affected, and no fix plan is available for it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA LibreOffice (The Document Foundation) Fixed in < 26.2.5

Red Hat 2 advisories

RHSA-2026:88164 Released 2026-10-22 · Red Hat rating Important
flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) autocorr-af-1:7.1.8.1-3.el8_10, autocorr-bg-1:7.1.8.1-3.el8_10, autocorr-ca-1:7.1.8.1-3.el8_10 +47
- Red Hat Enterprise Linux CRB (v. 8) libreoffice-sdk-1:7.1.8.1-3.el8_10, libreoffice-sdk-doc-1:7.1.8.1-3.el8_10
RHSA-2026:82013 Released 2026-10-13 · Red Hat rating Important
libreoffice security update
- Red Hat Enterprise Linux AppStream (v. 9) autocorr-af-1:7.1.8.1-15.el9_8.3, autocorr-bg-1:7.1.8.1-15.el9_8.3, autocorr-ca-1:7.1.8.1-15.el9_8.3 +47
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libreoffice-sdk-1:7.1.8.1-15.el9_8.3, libreoffice-sdk-doc-1:7.1.8.1-15.el9_8.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-05
The Document Foundation LibreOffice < 26.2.5
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-67605 Arbitrary file write via LibreOffice Calc data mappingsPriority LOW 29
- TI-2026-67609 Environment and INI file values leak through LibreOffice documentsPriority LOW 28
- TI-2026-67608 Local file read and SSRF in LibreOffice via HLS playlistsPriority LOW 28
Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 7	Affected	No fix yet
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2026:88164
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2026:82013
Red Hat Enterprise Linux CRB (v. 8)	Fixed	RHSA-2026:88164
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)	Fixed	RHSA-2026:82013

Not affected: 1 product

Red Hat Enterprise Linux 6

Timeline

2026-10-05 Threatist record created from CVE-2026-63277
2026-10-05 Alias added: GHSA-5jx8-5g92-5w59
2026-10-06 Affected versions changed · Red Hat
2026-10-06 CVSS score added · Red Hat
2026-10-13 Fix available: RHSA-2026:82013 · Red Hat
2026-10-13 Fix available: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · Red Hat
2026-10-23 Fix available: RHSA-2026:88164 · Red Hat
2026-10-23 Fix available: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · Red Hat
2026-10-30 Affected versions changed · Red Hat

References

Other 1

https://www.libreoffice.org/about-us/security/advisories/cve-2026-63277

TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5

See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences