CVE-2026-63277 Overview
CVE-2026-63277 is a high-severity vulnerability in LibreOffice Calc that allows arbitrary Java code execution when a user opens a crafted spreadsheet. LibreOffice Calc supports linking cell ranges to external data sources through Java database drivers. The flaw enables an attacker to specify a remote URL as the Java class path for the driver. Opening the document causes LibreOffice to load and execute Java code fetched from the attacker-controlled location. The vulnerability is tracked as CWE-829: Inclusion of Functionality from Untrusted Control Sphere.
Critical Impact
Opening a malicious LibreOffice Calc document triggers execution of remote Java code with the privileges of the current user, enabling full compromise of the host.
Affected Products
- LibreOffice (versions prior to the fix that restricts Java class path entries to file URLs)
- LibreOffice Calc component with Java database driver linking enabled
- Documents using external data source cell range links
Discovery Timeline
- 2026-10-05 - CVE CVE-2026-63277 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-63277
Vulnerability Analysis
LibreOffice Calc permits a cell range to be linked to an external data source, with the link definition persisted inside the document file. The link definition can name a Java Database Connectivity (JDBC) driver class to load. In vulnerable releases, the Java class path associated with the driver is not restricted to local file URLs. An attacker can therefore reference a remote URL, and the Java runtime will fetch the referenced classes from that location when the document is opened. The loaded Java code executes in the context of the LibreOffice process. This yields local code execution with the privileges of the user opening the spreadsheet.
Root Cause
The root cause is insufficient validation of Java class path entries used by linked external data sources. The affected code accepts arbitrary URL schemes for class path entries rather than restricting entries to local file:// URLs. This design allows classes to be sourced from attacker-controlled servers at document load time, meeting the pattern described by CWE-829.
Attack Vector
Exploitation requires an attacker to deliver a crafted Calc document to a victim and convince the victim to open it. The CVSS vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H reflects local attack vector with required user interaction. Common delivery mechanisms include email attachments, shared drives, and web downloads. Once opened, the document triggers resolution of the external data source link, which in turn pulls Java bytecode from the attacker's host and runs it in-process.
No verified public exploit code is available for this issue. See the LibreOffice Security Advisory CVE-2026-63277 for authoritative technical detail.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-63277
Indicators of Compromise
- Outbound network connections from soffice.bin or Java subprocesses spawned by LibreOffice to unexpected HTTP, HTTPS, or FTP endpoints when a spreadsheet is opened.
- LibreOffice Calc documents (.ods, .xlsx, .xls) containing external data source link definitions that reference non-file:// URLs in Java class path entries.
- Unexpected Java process execution chained from a LibreOffice parent process shortly after a user opens a document.
Detection Strategies
- Inspect office documents from untrusted sources for embedded JDBC driver references and remote class path URLs before opening.
- Build endpoint detection rules that flag soffice.bin or its Java child processes initiating outbound network connections to arbitrary hosts.
- Correlate document-open events with subsequent process creation and network activity to identify suspicious execution chains.
Monitoring Recommendations
- Monitor process creation events for Java runtimes launched as children of LibreOffice binaries.
- Alert on DNS lookups and HTTP requests originating from LibreOffice processes to non-corporate domains.
- Log and review opening of documents that contain external data source links referencing remote Java class paths.
How to Mitigate CVE-2026-63277
Immediate Actions Required
- Update LibreOffice to a fixed release that constrains Java class path entries to file:// URLs, as described in the LibreOffice security advisory.
- Avoid opening Calc documents from untrusted or unverified sources until patching is complete.
- Disable the Java runtime integration within LibreOffice if it is not required for business workflows.
Patch Information
LibreOffice has released fixed versions in which an entry in a Java class path must be a file URL. Refer to the LibreOffice Security Advisory CVE-2026-63277 for the specific affected and patched version numbers and distribution-specific guidance.
Workarounds
- In LibreOffice, open Tools → Options → LibreOffice → Advanced and disable Use a Java runtime environment to prevent JDBC driver loading.
- Block outbound network traffic from LibreOffice processes at the host firewall where Java integration must remain enabled.
- Enforce organizational policy that opens untrusted spreadsheets in a sandboxed or isolated environment.
# Disable Java in LibreOffice via user configuration (Linux example)
# Edit the user registrymodifications.xcu to turn off Java runtime use
sed -i 's|<item oor:path="/org.openoffice.Office.Java/VirtualMachine"><prop oor:name="Enable" oor:op="fuse"><value>true</value></prop></item>|<item oor:path="/org.openoffice.Office.Java/VirtualMachine"><prop oor:name="Enable" oor:op="fuse"><value>false</value></prop></item>|' \
~/.config/libreoffice/4/user/registrymodifications.xcu
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
