LibreOffice Calc: Remote code execution via Java JDBC driver in data link
Summary
LibreOffice Calc can save a link from a cell range to an external data source in a document. A crafted document can name a Java database driver that is loaded from a remote location, so opening it can run Java code from that location. Exploitation requires that the user opens the file and that Java and JDBC support is installed and enabled in LibreOffice.
Affected
- LibreOffice 26.2 before 26.2.5
- Whether the 26.8 line was affected before 26.8.0 is unknown.
Fixed in
- LibreOffice 26.2.5
- LibreOffice 26.8.0
- Upgrade to 26.2.5 or 26.8.0 or later.
Workaround
- Disable Java in LibreOffice where it is not needed. The menu path differs between versions, so confirm it in the installed version (Tools > Options > LibreOffice > Advanced, or Tools > Options > OpenOffice > Java).
- Restrict Java class path entries to file URLs, which is the same change as the fix.
Exploitation
- Public proof of concept available (V12 Security).
- No exploitation in the wild reported.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Listing in the CISA KEV catalog not verified.
Our recommendation
- Update LibreOffice to 26.2.5 or 26.8.0 on all workstations.
- Until the update is installed, disable Java in LibreOffice where it is not required.
- Treat spreadsheets received by email or downloaded from the internet with caution.
- Check the installed LibreOffice versions and Java settings in your inventory.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
HORKimhab/CVE-2026-63277
Research sources
- LibreOffice security advisory CVE-2026-63277 www.libreoffice.org
- Red Hat CVE-2026-63277 access.redhat.com
- Debian security tracker: libreoffice security-tracker.debian.org
- VulDB entry 413593 vuldb.com
- V12 Security PoC repository (LibreOffice) github.com
- Byteiota: patch now or disable Java byteiota.com
- CyberKendra: LibreOffice/OpenOffice Calc RCE www.cyberkendra.com
- The Hacker Wire: CVE-2026-63277 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:28.
Original description (NVD)
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.