LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

A proof-of-concept demonstrates that a crafted LibreOffice or Apache OpenOffice Calc spreadsheet can trigger remote code execution by referencing an external ODB that loads a JDBC driver JAR and runs Java code when Java support is enabled. LibreOffice patched the issue (CVE-2026-63277) in recent updates; Apache OpenOffice (CVE-2026-59265) is still affected up to 4.1.16 with a fix expected in 4.1.17. Researchers recommend updating LibreOffice, disabling Java in OpenOffice, or not opening untrusted spreadsheets.