PT-2026-104818

CVE-2026-63277

Published

2026-10-05

Updated

2026-10-22

Description by

CVSS 4.0

8.5

High

MetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LibreOffice Calc versions prior to 26.2.5

Description LibreOffice Calc allows linking a cell range to an external data source, with the link saved within the document. An attacker can specify a Java database driver to be loaded from a remote location via the calcext:data-mappings mechanism, the SQL provider, and the JDBC connector. When the document is opened, the application may execute Java code from that remote class path URL, leading to remote code execution.

Recommendations Update to version 26.2.5.

Exploitability

Exploit

Fix

Impacts

Researchers

Caolán Mcnamara

Vendors

Affected products

Weakness enumeration

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Related identifiers