🚨 The Spreadsheet That Can Become a Code-Execution Trigger: LibreOffice Calc CVE-2026-63277

CyberRakshakLabs analyzes LibreOffice Calc CVE-2026-63277, where a crafted spreadsheet can abuse external data mappings and a remote Java driver to reach code execution.

What if the spreadsheet never runs a macro — yet still reaches code execution?
CVE-2026-63277 shows how a crafted LibreOffice Calc document can turn an external data-link feature into a code-execution path through a remote Java database driver.

HIGHSeverity

26.2.5 / 26.8.0Fixed versions

3Key components in the vulnerable chain

Important: The supplied research describes a document-triggered code-execution path. Do not open untrusted Calc spreadsheets, especially those containing unexpected external data links.

1. Executive Summary

CVE-2026-63277 is a High-severity LibreOffice Calc RCE. The vulnerable path abuses Calc’s external data-link mechanism: a crafted document can define a mapping using the SQL provider and JDBC connector and reference a Java database driver at a remote location. Opening the document can cause Java code from that location to run.

The security lesson is important for ordinary users: a spreadsheet is not always passive data. Application features that process external references can create an execution path before the user ever sees suspicious macros or an executable attachment.

The supplied research notes that the vendor fixed the issue in LibreOffice 26.2.5 and 26.8.0 and that public enrichment reported CVSS 8.5 High with no known exploitation at the time checked. That status should be treated as time-bound rather than a guarantee of future non-exploitation.

Research posture: The article focuses on the vendor-described execution boundary and defensive implications; weaponized exploit details are intentionally omitted.

2. Technical Root Cause

LibreOffice Calc supports external data mappings. The vulnerable chain involves `calcext:data-mappings`, the SQL provider and JDBC connector. A document could name a Java database driver to be loaded from a remote location. The driver-loading path could therefore become a code-execution boundary.

Calc document→External data mapping→SQL provider→JDBC connector→Java driver reference→Remote driver loading→Java code execution

Vendor fix: in fixed versions, an entry in a Java class path has to be a file URL, blocking the described remote-driver path. The official LibreOffice security advisory lists CVE-2026-63277 as “RCE via calcext:data-mappings, sql provider and jdbc connector” and states that it is fixed in 26.2.5 and 26.8.0.

3. Supplied Evidence

Supplied LibreOffice Calc screenshot showing the connection error/driver-loading context associated with the research input. — Figure 1. Screenshot supplied in the input document.

The screenshot is source-provided evidence from the research document. It shows LibreOffice Calc with an external-connection message visible over the spreadsheet. The image supports the presence of the described external-data interaction, but the screenshot alone is not a standalone proof of successful exploitation.

4. Defensive Attack Flow

Defensive attack flow for CVE-2026-63277, from crafted Calc document through external data mapping and JDBC to Java code execution. — Figure 2. Defensive reconstruction based on the vendor description; weaponized payload details are intentionally omitted.

The flow is a defensive reconstruction of the dependency chain rather than a reproduction of a working exploit.

5. Simplified Technical Representation

Calc document
  → external data mapping
     → SQL provider
        → JDBC connector
           → Java driver reference
              → pre-fix remote driver loading
                 → Java code execution

This representation explains the dependency chain without reproducing a working exploit or payload.

6. Impact on Normal Users

Opening a malicious spreadsheet can trigger code execution.

Execution occurs with the privileges of the LibreOffice user.

Accessible files, credentials and business data may become exposed after successful execution.

A spreadsheet can look harmless because the active behavior is embedded in document metadata rather than visible cells.

Unexpected spreadsheets received through email, chat or external sharing should be treated as untrusted content.

7. Detection & Hunting

Monitor LibreOffice spawning unexpected Java processes or command interpreters.

Correlate document-open events with outbound network connections.

Inspect suspicious Calc documents for external data mappings, JDBC references and unusual remote data sources.

Monitor DNS/proxy logs immediately after LibreOffice opens a document.

Preserve the original document, endpoint process tree and network telemetry during investigation.

For a SOC, the key correlation is the sequence: document opened → LibreOffice activity → unexpected Java/child process behavior → outbound network activity. Any such chain should be investigated in context.

8. Remediation

Upgrade to LibreOffice 26.2.5 or 26.8.0 or later, as applicable.

Prioritize endpoints that regularly process externally supplied spreadsheets.

Until patching, avoid opening untrusted Calc documents, especially those expected to contain external data links.

Use EDR/application control to monitor LibreOffice child processes.

Educate users that modern documents can contain active external-resource behavior.

LibreOffice’s official security advisory confirms that CVE-2026-63277 is fixed in 26.2.5 and 26.8.0. The release-notes page also shows the 26.2.6 branch, so organizations on the 26.2 line should use the current supported bugfix release appropriate to their environment.

9. MITRE ATT&CK Relevance

Technique	Relevance
T1204.002 — User Execution: Malicious File	User opens the crafted document.
T1203 — Exploitation for Client Execution	Application behavior is exploited for code execution.
T1105 — Ingress Tool Transfer	Potential post-exploitation transfer; not inherent to the CVE.
T1059 — Command and Scripting Interpreter	Potential follow-on command execution; payload-dependent.

The mapping is defensive context, not a statement that every technique is observed in a real-world incident involving this CVE.

10. CyberRakshakLabs Assessment

The strongest defense is not only patching. Users and organizations must change the assumption that a spreadsheet is passive. Patch LibreOffice, restrict untrusted documents, monitor application child processes and investigate unexpected network activity.

The most important technical lesson is the execution boundary created by document-driven external-resource handling. A malicious spreadsheet does not need a visible macro or a dropped executable to create risk when the application follows an unsafe external reference path.

🔴 One spreadsheet. One open action. Potential code execution.

11. Sources & Verification Notes

Supplied research document: CyberRakshakLabs LibreOffice CVE-2026-63277 research brief, including the supplied screenshot and defensive attack-flow figure.

LibreOffice Security Advisories: CVE-2026-63277 advisory and fixed-version guidance ↗

LibreOffice Release Notes: Current supported release information ↗

The supplied document’s public-enrichment statements are treated as time-bound research input. This page does not claim that the CVE is being actively exploited unless independently confirmed by a source.

Recommended CyberRakshakLabs Headline

The Spreadsheet That Can Become a Code-Execution Trigger: LibreOffice Calc CVE-2026-63277

Subtitle: A crafted spreadsheet can reach Java code execution through LibreOffice Calc’s external data-link handling — proving that document security is also application security.