CVE-2026-63266
published 2026-10-05CVE-2026-63266: LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded…
PriorityP428medium6.8CVSS 4.0
AVLACLATNPRNUIPVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.16%
4.3th percentile
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libreoffice | libreoffice | — | — |
| the_document_foundation | libreoffice | >= 26.2 < < 26.2.5 | < 26.2.5 |
CVSS provenance
nvdv4.06.8MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libreoffice: LibreOffice: Arbitrary file write via embedded Firebird database links
vendor_redhat·2026-10-05·CVSS 6.8
CVE-2026-63266 [MEDIUM] CWE-22 libreoffice: LibreOffice: Arbitrary file write via embedded Firebird database links
libreoffice: LibreOffice: Arbitrary file write via embedded Firebird database links
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.
A flaw was found in LibreOffice. When processing a spreadsheet with a cell range linked to an external data source, LibreOffice Calc can load an embedded Firebird database that writes files outside its intended directory. By convincing a user to open a specially crafted document, an attacker could create or overwrite arbitrary files with the permissions of the vi
GHSA
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.
ghsa_unreviewed·2026-10-05
CVE-2026-63266 [MEDIUM] CWE-22 LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.
No detection rules found.
No public exploits indexed.
2026-10-05
Published