CVE-2026-63267

A flaw was found in LibreOffice. When loading a spreadsheet, external comma-separated values (CSV) data links were automatically fetched without applying standard link update controls. A remote attacker could exploit this vulnerability by enticing a user to open a specially crafted document, causing the application to read local files into the sheet or initiate outbound network requests, resulting in information disclosure.

LibreOffice Calc automatically fetches external CSV data links during document load without enforcing standard link update control policies. By convincing a user to open a specially crafted spreadsheet, an attacker can leverage these automatic external queries to read arbitrary local files into spreadsheet cells or trigger unauthorized outbound network requests. This allows a local or remote adversary to exfiltrate sensitive local data or conduct internal network probing under the security context of the user opening the file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, configure LibreOffice Calc security options to disable or prompt for automatic updating of external links when opening documents from untrusted sources.