Malicious Spreadsheets Run Code in LibreOffice and OpenOffice Without Macro Warnings

Security researchers have demonstrated that a malicious spreadsheet can make LibreOffice and Apache OpenOffice execute arbitrary code the instant the file is opened. The familiar warning both suites show before running a macro never appears.

The attack works only when the program's Java support is enabled. For now it exists solely as a proof of concept, and there are no reports of it being used in real attacks.

Two projects, two fates

LibreOffice has already fixed the flaw, which it tracks as CVE-2026-63277, in updates released on October 5. Users are advised to move to version 26.2.5 or 26.8.0; earlier releases are affected.

Apache OpenOffice has not yet closed the matching flaw (CVE-2026-59265). Every version up to and including the current 4.1.16 is vulnerable; a fix is expected in release 4.1.17, which is still in testing. Until then, users can disable Java in the program's settings or simply avoid opening spreadsheets they do not trust.

How the attack comes together

The attack chains together features that each behave exactly as intended on their own. A Calc spreadsheet can hold a "database range" — a block of cells that pulls in data from an outside source and refreshes it automatically. That source can be a separate database file in ODB format, named by a web address written straight into the spreadsheet.

When the document opens, the range refreshes and the program downloads the ODB from that address. The ODB can name a Java database driver (JDBC) and point to where its code lives — a JAR file, which may also sit on a remote server. The program fetches the JAR and starts the driver, which is the attacker's code, inside the application itself.

The real problem, the researchers say, is that these ordinary mechanisms together reach code execution without ever asking the user to trust the document — unlike the prompt that guards macros.

The demonstration

In the proof of concept the driver merely opens the Calculator app, a harmless stand-in, but the same path can run any Java code the attacker chooses. The attack was tested on Windows and Linux and is not tied to any one operating system. For convenience the malicious files sat on the same machine in the demonstration, but a real attack would place the database file and the code on an attacker-controlled server.

The LibreOffice flaw was reported independently by Rick de Jager of the V12 security team and by Thomas Rinsma and Edoardo Geraci of Codean Labs; Apache credits Codean Labs for the matching OpenOffice issue. The V12 team has published proofs of concept for both programs, and Caolán McNamara of Collabora Productivity wrote the LibreOffice fix.

Source: The Hacker News