LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

Researchers have published a proof-of-concept technique that lets a booby-trapped Calc spreadsheet execute arbitrary code the moment it's opened, bypassing the usual macro-security prompt in both LibreOffice and Apache OpenOffice. The trick abuses a legitimate "database range" feature: the spreadsheet points to an external ODB database file, which in turn references a remote JDBC driver JAR that gets downloaded and loaded automatically, effectively running attacker-supplied Java code as soon as Java support is enabled. LibreOffice has already patched its flaw, tracked as CVE-2026-63277, in the October 5 releases 26.2.5 and 26.8.0, while Apache OpenOffice's equivalent issue, CVE-2026-59265, remains unfixed in all versions through 4.1.16, with a patch expected in 4.1.17. There is no known in-the-wild exploitation yet, but OpenOffice users are advised to disable Java or avoid opening untrusted spreadsheets until a fix ships.