CVE-2026-63277: RCE via calcext:data-mappings, sql provider and jdbc connector
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
Affected Software
Event History
Frequently Asked Questions
What must an attacker include in a document to exploit this issue?
The document must contain a Calc external data link using calcext:data-mappings with the SQL provider and JDBC connector, and name a Java database driver located remotely. Opening the document can then cause Java code from that location to run.
What is the relevant mitigation if updates cannot be applied immediately?
Avoid opening untrusted LibreOffice Calc documents, particularly documents that may contain external data-source links. The supplied information does not identify a configuration workaround beyond using a fixed version.
How do fixed versions prevent remote driver loading?
Fixed versions require each Java class-path entry to be a file URL. This prevents the described use of a remotely located Java database driver.