Malicious spreadsheets can run Java code

A malicious spreadsheet can execute Java code as soon as it is opened in LibreOffice or Apache OpenOffice, without warning, when Java support is enabled. The vulnerabilities in both office suites allow a spreadsheet to become an entry point for malicious code.

Vulnerabilities discovered by multiple researchers

The discovery was independently reported by Rick de Jager, a member of the V12 team, as well as by Thomas Rinsma and Edoardo Geraci, from Codean Labs. The latter also studied the problem in Apache OpenOffice, and the opinion published for this second software credits the three researchers.

How the attack works

The starting point is a database range, that is, a set of cells supplied by an external source. This function allows importing information and automatically updating it. The spreadsheet refers to an ODB file, a database document, using an address integrated into the spreadsheet. Upon opening, the update triggers the retrieval of this file.

Triggering the execution

This file can contain the parameters of a JDBC driver, the Java component responsible for ensuring communication with a database. It can also point to a JAR archive that contains the driver code, including when this archive is hosted on a remote server. The sequence of these operations constitutes the core of the attack.

Java must be enabled for the attack to work

The technical condition remains decisive: Java must be enabled in the office suite. The risk described therefore depends on the configuration of the software used to open the file. Presenting each installation as automatically exploitable would eliminate an essential detail for evaluating the actual exposure.

Demonstrations show the vulnerability in action

The demonstrations reported by V12 use the launching of the calculator to materialize the execution of code. This action serves as an observable proof. It does not limit the scope of the vulnerability, since the mechanism allows the execution of another Java program chosen by the attacker.

Vulnerability affects multiple operating systems

The researchers report tests under Windows and Linux. Their analysis indicates that the process does not depend on a single operating system. However, the provided elements do not document any campaign currently using these flaws. The announced availability of demonstrations therefore does not constitute proof of already occurred compromises.

LibreOffice has released a fix

For LibreOffice, the problem has the identifier CVE-2026-63277. The security notice, announced on October 5, 2026, indicates that versions 26.2.5 and 26.8.0 contain the fix. Users must install a corrected version from their branch or a later version.

Apache OpenOffice needs a configuration change

The situation for Apache OpenOffice requires an immediate configuration measure. The notice from October 2, 2026, classifies CVE-2026-59265 as critical and indicates that versions up to 4.1.16 are affected. It announces a fix expected in version 4.1.17, currently in final preparation. In the meantime, disabling the Java integration in the preferences prevents the described attack.