CVE-2026-63277

CVE-2026-63277 is a vulnerability in LibreOffice Calc that allows a spreadsheet to execute arbitrary Java code when opened. The issue stems from a feature called "database range," which allows a block of cells to pull and refresh data from an external source. A crafted spreadsheet can point to a remote database document (an ODB file) that specifies a Java database driver (JDBC driver) hosted on an external server. When the spreadsheet is opened, Calc automatically downloads and runs the remote Java code without displaying the typical warnings associated with macros. The vulnerability only affects systems where Java support is enabled within the office suite. LibreOffice addressed the flaw in its October 5, 2026 updates (versions 26.2.5 and 26.8.0) by requiring that entries in a Java class path use a local file URL. A matching vulnerability exists in Apache OpenOffice (tracked as CVE-2026-59265), which remains unpatched in versions up to 4.1.16, though users can mitigate the risk by disabling Java support in their settings.