CVE-2026-63267 in LibreOffice
Summary
by MITRE • 10/05/2026
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified involves LibreOffice Calc, specifically within its handling of external data source links associated with cell ranges. This flaw allows an attacker to craft a malicious document that contains embedded references to external CSV files or remote hosts. When such a document is opened by a victim, the application automatically attempts to resolve these links during the loading process. Unlike other types of spreadsheet links which are typically subject to user confirmation prompts before updating data from external sources, this specific mechanism for fetching linked cell ranges bypasses standard security controls. Consequently, opening a seemingly innocuous file can result in unintended side effects such as reading sensitive local files into the sheet or initiating network requests to arbitrary hosts determined by the document creator.
From a technical perspective, the core issue lies in the asynchronous and automatic nature of how LibreOffice Calc processes certain external data connections upon document initialization. The application treats these specific cell range links differently than standard OLE objects or database queries that require explicit user interaction for updates. This inconsistency creates an opportunity for unauthorized information disclosure or potential remote code execution vectors if combined with other vulnerabilities, although the primary impact described is related to data exfiltration and network activity without consent. The lack of a prompt means users are unaware that their system is accessing local filesystems or communicating over the network based on content embedded within the document itself.
The operational impact of this vulnerability is significant for organizations relying on LibreOffice Calc for processing shared documents. An attacker could distribute malicious files via email, file sharing services, or web downloads to trigger these automatic fetches. This can lead to the leakage of internal data if local paths are resolved and read into the spreadsheet cells. Furthermore, making requests to arbitrary hosts allows attackers to perform reconnaissance, establish command-and-control channels through HTTP/HTTPS traffic disguised as normal application behavior, or exploit server-side request forgery scenarios where the victim's LibreOffice instance acts as a proxy for malicious actions against internal infrastructure. This undermines trust in document exchange and poses risks to network security posture by generating unexpected outbound connections that may bypass firewall rules designed to monitor user-initiated browsing activity rather than application-driven data retrieval.
To mitigate this risk, users should ensure they are running fixed versions of LibreOffice where external data links are updated under the same strict link update control as other spreadsheet elements. This means requiring explicit user confirmation before any external data is fetched or refreshed. Administrators can also enforce security policies that disable automatic updating of linked data by default within group policy settings, forcing users to manually trigger updates only after verifying the source's integrity. Additionally, employing application whitelisting and monitoring outbound network traffic from office applications can help detect anomalous behavior indicative of such exploitation attempts. Awareness training for end-users regarding the risks associated with opening documents from untrusted sources remains a critical layer of defense against social engineering tactics that leverage these technical flaws.
This vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to adequately validate or restrict actions triggered by external data links before execution. It also relates to CWE-918 Server-Side Request Forgery (SSRF) in contexts where the client-side application is used to make requests on behalf of an attacker against internal resources. In terms of attack tactics, this behavior corresponds to ATT&CK technique T1059 Command and Scripting Interpreter if scripts are involved in processing the fetched data, or more broadly to Initial Access vectors involving malicious files that exploit trust relationships within software applications. The fix ensures parity with other link types, thereby restoring user control over potentially dangerous operations initiated by document content.