CVE-2026-63277

A flaw was found in LibreOffice. When linking spreadsheet cell ranges to external data sources in Calc, a document can specify an external Java database driver. By convincing a user to open a specially crafted document, a remote attacker can force the application to download and execute untrusted Java code from a remote location, resulting in arbitrary code execution.

Vulnerability in LibreOffice Calc allows execution of untrusted Java code via remote Java database driver paths in spreadsheet cell range links. When an attacker tricks a user into opening a specially crafted spreadsheet document, Calc downloads and executes arbitrary remote Java code under the security context of the logged-in user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restricting the LibreOffice Java class path settings to local file system schemes (file:// URLs) prevents the execution of untrusted code from remote network locations. Alternatively, disabling the Java Runtime Environment (JRE) in LibreOffice options (Tools -> Options -> LibreOffice -> Advanced) eliminates the attack vector.