CVE-2026-63266

A flaw was found in LibreOffice. When processing a spreadsheet with a cell range linked to an external data source, LibreOffice Calc can load an embedded Firebird database that writes files outside its intended directory. By convincing a user to open a specially crafted document, an attacker could create or overwrite arbitrary files with the permissions of the victim.

LibreOffice Calc allows cell ranges to link to external data sources, which are stored within the document structure. A spreadsheet containing a crafted link can trigger LibreOffice Calc to automatically load an embedded Firebird database, which fails to properly restrict path access. Consequently, an attacker can leverage a specially crafted spreadsheet to write or overwrite arbitrary files on the local filesystem with the permissions of the user opening the document.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

As a temporary workaround, restrict access to or disable automatic update of linked external data sources in LibreOffice Calc preferences, or block opening untrusted files containing embedded Firebird database connections.