CVE-2026-63278: Information Disclosure Vulnerability

CVE-2026-63278 Overview

CVE-2026-63278 is an information disclosure vulnerability in LibreOffice. Crafted URLs inside a document can trigger expansion of environment variables or INI file values when the document is opened. The expanded values are then transmitted to a remote server, exposing potentially sensitive host information.

The issue is an incomplete fix for CVE-2024-12426. The prior patch checked for the package content provider by name but did not recognize every naming variant an attacker could use. A URL that referenced the provider through an alternate name bypassed the check and reached the expansion code path.

Critical Impact
Opening a malicious document can exfiltrate environment variables and INI file values to an attacker-controlled server without further user interaction beyond opening the file.

Affected Products

LibreOffice (versions prior to the fixed release per the vendor advisory)
Documents processed by the affected URL handling logic in the package content provider
Deployments still relying on the incomplete CVE-2024-12426 mitigation

Discovery Timeline

2026-09-22 - CVE-2026-63278 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-63278

Vulnerability Analysis

The flaw is an information exposure issue classified as [CWE-200]. LibreOffice supports URL constructions that reference internal providers, including a package content provider used for embedded content. When a URL is resolved, LibreOffice may expand tokens that reference environment variables or values from INI configuration files.

The original fix for CVE-2024-12426 added a check to block expansion when the target was the package content provider. That check compared the provider name against a single canonical form. Attackers can name the same provider using alternate strings that bypass the string comparison but still resolve to the vulnerable code path.

On document open, LibreOffice processes the embedded links and performs the expansion. The expanded content is then sent as part of an outbound request to a remote host under attacker control.

Root Cause

The root cause is incomplete input validation in the URL check added by the CVE-2024-12426 patch. The comparison did not normalize provider naming, allowing multiple aliases to reach the expansion logic. The fixed versions match the package content provider consistently when the URL is validated.

Attack Vector

Exploitation requires local file interaction. An attacker delivers a document containing crafted URLs through email, file share, or download. The victim opens the document in a vulnerable LibreOffice build. LibreOffice expands referenced environment variables or INI values and issues a network request to the attacker's server carrying the resolved data.

The vulnerability requires user interaction to open the document. No elevated privileges are needed on the target host beyond the ability to run LibreOffice.

The exploitation technique is described in the LibreOffice Security Advisory CVE-2026-63278. No proof-of-concept code is publicly available at time of publication.

Detection Methods for CVE-2026-63278

Indicators of Compromise

Outbound HTTP or HTTPS requests originating from soffice.bin or soffice.exe to unexpected external hosts shortly after a document is opened
Request URIs or query strings containing values resembling local environment variables such as USERNAME, USERPROFILE, PATH, or HOME
Office documents containing embedded links referencing package content provider aliases or vnd.sun.star.* URL schemes with expansion tokens

Detection Strategies

Inspect email attachments and file share uploads for documents containing suspicious URL schemes referencing internal LibreOffice providers
Correlate LibreOffice process launches with immediate outbound network connections to non-corporate destinations
Deploy endpoint telemetry that captures process command lines, file opens, and network egress for office application processes

Monitoring Recommendations

Alert on LibreOffice processes initiating DNS lookups or web requests to newly observed domains within seconds of a document open event
Monitor DLP and web proxy logs for outbound requests containing strings matching known environment variable naming patterns
Baseline normal LibreOffice network behavior in the environment and flag deviations, particularly connections to low-reputation hosts

How to Mitigate CVE-2026-63278

Immediate Actions Required

Update LibreOffice to the fixed version listed in the LibreOffice Security Advisory CVE-2026-63278
Inventory all endpoints running LibreOffice and prioritize systems that handle documents from external sources
Instruct users to avoid opening untrusted .odt, .ods, and related documents until patching completes

Patch Information

The Document Foundation released fixed LibreOffice builds that match the package content provider consistently during URL validation. Refer to the vendor advisory for the specific version numbers and download locations. Administrators should replace the CVE-2024-12426 mitigation with the new patched build because the prior fix is incomplete.

Workarounds

Restrict LibreOffice outbound network access at the host or perimeter firewall to prevent exfiltration if a malicious document is opened
Open untrusted documents inside a sandboxed or isolated environment that lacks sensitive environment variables and network reachability
Configure email gateways and file scanners to quarantine office documents containing suspicious embedded URL schemes

bash

# Example: block LibreOffice outbound traffic on Linux using iptables
# Adjust the binary path and user context to match your deployment
sudo iptables -A OUTPUT -m owner --uid-owner libreoffice-user \
  -p tcp --dport 80 -j REJECT
sudo iptables -A OUTPUT -m owner --uid-owner libreoffice-user \
  -p tcp --dport 443 -j REJECT