LibreOffice and Apache OpenOffice Flaw Enables Remote Code Execution via Malicious Calc Tables Without Macro Warnings

Researchers have demonstrated an attack against LibreOffice and Apache OpenOffice users that executes arbitrary Java code simply by opening a malicious spreadsheet, without requiring macro permissions or triggering any security prompts. The vulnerability requires Java support to be enabled in the office suite and exploits legitimate features in the Calc component that automatically fetch data from external database sources. When a crafted document is opened, Calc loads a linked database file that references a malicious Java driver, allowing the attacker’s code to run inside the office process. LibreOffice has already patched the issue tracked as CVE-2026-63277 with the release of versions 26.2.5 and 26.8.0 on October 5, while Apache OpenOffice remains vulnerable up to version 4.1.16 under CVE-2026-59265 with a fix expected in 4.1.17. The attack chain works on both Windows and Linux and bypasses macro protections entirely because no user consent dialog appears. Although only a proof-of-concept exploit that launches the calculator has been published so far, the same technique can execute any Java payload. Users of OpenOffice are advised to disable Java or avoid untrusted files until the patch is available.

AntiMalwareOctober 7, 2026Translated from Russian

Read at source

Security researchers have uncovered a vulnerability in LibreOffice and Apache OpenOffice that allows attackers to execute arbitrary code simply by tricking users into opening a malicious spreadsheet file.

The attack does not rely on macros and therefore bypasses the usual security warnings that appear when macros are present. The only prerequisite is that Java support must be enabled inside the office suite.

The flaw stems from the interaction between two legitimate features. LibreOffice Calc can automatically refresh cell ranges from an external database source. When a specially crafted document is opened, the application loads the referenced database file, which in turn points to a Java driver supplied by the attacker. This driver executes inside the office process, granting the attacker full code execution capabilities.

LibreOffice addressed the issue, tracked as CVE-2026-63277, by releasing versions 26.2.5 and 26.8.0 on 5 October. Users are strongly encouraged to update immediately.

Apache OpenOffice is affected by a similar vulnerability, CVE-2026-59265, in all versions up to and including 4.1.16. A patch is planned for version 4.1.17, which is still undergoing testing. Until the update is released, OpenOffice users should either disable Java in the application settings or refrain from opening untrusted spreadsheet files.

The researchers demonstrated the attack by launching the system calculator, confirming remote code execution. The same method can be used to run any Java payload. The issue was confirmed on both Windows and Linux. No evidence of active exploitation in the wild has been observed yet.

LibreOffice Apache OpenOffice CVE-2026-63277 CVE-2026-59265

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

CISA Adds Cisco Secure Firewall and GitLab Flaws to Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-76418 affects Cisco Secure Firewall ASA and FTD software, allowing unauthenticated attackers to trigger device reboots and denial-of-service conditions. CVE-2026-97229 impacts GitLab through an integer overflow tied to insufficient regex validation in CI/CD configurations, enabling remote code execution without authentication. CISA notes that the GitLab issue stems from an underlying flaw in the Ruby/Onigmo dependency and may affect additional products. Organizations are urged to apply patches immediately to prevent further exploitation in the wild.

Security NEXTOct 29, 2026Translated from Japanese

Vulnerabilities & Exploits

Telegram for Android Patches Voice Call Vulnerability Enabling Code Execution

Security researchers at NebuSec disclosed a vulnerability in Telegram for Android that allowed remote code execution after a victim answered a voice call. The flaw affected versions from 8.6.2 through 12.10.3 and was fixed in release 12.10.4 at the end of September. The issue stemmed from improper handling of MediaState service messages that carry microphone, camera, and video rotation data during calls. When a required field was missing, the application accessed invalid memory. NebuSec discovered the bug using its Code Security product running on a GPT-5.4 model and confirmed exploitation on ARM64 Android devices for personal calls. A demonstration showed the string “HACKED BY NEBUSEC” appearing roughly 30 seconds after the call was accepted. The vulnerability is unrelated to the earlier animated-sticker attack vector.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Yandex Patches Millions of Stations After eMudhra Certificate Keys Compromised

Yandex has automatically deployed security updates to millions of its smart speakers and partner televisions running YaOS between October 21 and 23. The patches address compromised intermediate certificates issued by eMudhra whose private keys consisted of trivial values from 1 to 255. Attackers who obtained these keys could generate fraudulent certificates and perform man-in-the-middle attacks against device HTTPS traffic. Enthusiasts demonstrated that local network control combined with the certificates allowed replacement of server configuration, activation of ADB, and acquisition of root access on the devices. The update removes trust in the affected certificates, overwrites compromised system files, and disables the debug interface. A factory reset restores the vulnerable firmware, so Yandex advises against resets without a compelling reason.

AntiMalwareOct 29, 2026Translated from Russian