Skip to content
OpenAdvisories
High WID-SEC-2026-3738 6 CVEs

LibreOffice: Mehrere Schwachstellen

Published Oct 5, 2026 · Updated Nov 11, 2026 · Revision 7 · de

Vendor: Debian Vendor: Oracle Vendor: Red Hat Vendor: RESF Product: Enterprise Linux Product: Linux Product: Linux Product: Rocky Linux Platform: Linux Platform: macOS Platform: Windows

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in LibreOffice ausnutzen, um Informationen offenzulegen, Daten zu manipulieren und beliebigen Code auszuführen.

Product

LibreOffice ist eine leistungsfähige Office-Suite, voll kompatibel mit den Programmen anderer großer Office-Anbieter, für verbreitete Betriebssysteme wie Windows, GNU/Linux und Apple Mac OS X geeignet. LibreOffice bietet sechs Anwendungen für die Erstellung von Dokumenten und zur Datenverarbeitung: Writer, Calc, Impress, Draw, Base und Math.

Vulnerabilities 6

  • High 8.5
    CVE-2026-63277 Public exploit

    RCE via calcext:data-mappings, sql provider and jdbc connector

    LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that l…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 6.8
    CVE-2026-63266

    Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality

    LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an e…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 6.7
    CVE-2026-63267

    LFI and GET SSRF via calcext:data-mappings and csv provider

    LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the d…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 6.7
    CVE-2026-63268

    LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href

    LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 6.7
    CVE-2026-63269

    LFI and GET SSRF via GStreamer and HLS playlists

    LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their cont…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 6.7
    CVE-2026-63270

    Environment/ini-file leaks

    URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every …

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu

Revision history

  1. #7

    Neue Updates von Red Hat aufgenommen

  2. #6

    Neue Updates von Oracle Linux aufgenommen

  3. #5

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  4. #4

    Neue Updates von Red Hat aufgenommen

  5. #3

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  6. #2

    Neue Updates von Red Hat aufgenommen

  7. #1

    Initiale Fassung

References