Data Exposure Vulnerability in LibreOffice Calc
CVE-2026-63268

6.7MEDIUM

Key Information:

Vendor

The Document Foundation

Status
Libreoffice
Vendor
CVE Published:
5 October 2026

What is CVE-2026-63268?

LibreOffice Calc has a vulnerability that allows it to link a range of cells to external data sources. When a document containing such a link is opened, it can inadvertently access local text files, posing a security risk. This vulnerability highlights the importance of careful handling of external data links within documents. Fixed versions restrict access only to specific data providers such as CSV, HTML, and XML, mitigating the potential for unauthorized file access.

Affected Version(s)

LibreOffice 26.2

References

https://www.libreoffice.org/about-us/security/advisories/...

CVSS V4

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thomas Rinsma and Edoardo Geraci from Codean Labs
Caolán McNamara of Collabora Productivity
.