Security researchers have demonstrated a vulnerability in LibreOffice and Apache OpenOffice that allows malicious spreadsheets to execute code automatically when opened, without displaying the warning messages typically shown before running macros. The attack requires Java support to be enabled in the affected applications. Currently, the vulnerability exists only as a proof of concept with no confirmed real-world attacks reported.
LibreOffice has already released patches addressing the flaw, tracked as CVE-2026-63277, with users advised to update to version 26.2.5 or 26.8.0. Apache OpenOffice has not yet fixed the matching vulnerability, designated CVE-2026-59265, though a fix is expected in the upcoming version 4.1.17. Until then, OpenOffice users can mitigate the risk by disabling Java in program settings or avoiding opening untrusted spreadsheet files. The attack exploits legitimate features that work together to download and execute malicious code without user consent.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
