CVE-2026-63267
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.
Risk Assessment
An attacker could exploit this vulnerability to read local files or make requests to arbitrary hosts, potentially leading to data leakage or unauthorized actions.
Recommendation
Update LibreOffice to the patched version. Avoid opening documents from untrusted sources.
Other vulnerabilities in LibreOffice
See all- CVE-2016-4324High
Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.
- CVE-2016-0795High
LibreOffice versions before 5.0.5 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document.
- CVE-2014-9093High
LibreOffice versions before 4.3.5 allow remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.
- CVE-2014-0247High
LibreOffice version 4.2.4 automatically executes unspecified VBA macros, which may lead to unknown impacts and attack vectors.
- CVE-2017-8358Critical
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.
- CVE-2017-7882Critical
LibreOffice before March 14, 2017, has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
- CVE-2017-7870Critical
LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.
- CVE-2017-7856Critical
LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function.
- CVE-2016-10327Critical
LibreOffice before December 22, 2016, has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx.
- CVE-2026-63277High
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
Original NVD description (English source)
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS