Remote Java Code Execution Through External Data Links in The Document Foundation LibreOffice Calc

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.

The normalized record identifies LibreOffice 26.2 series versions before 26.2.5 as affected.

The vendor identifies LibreOffice 26.2.5 and LibreOffice 26.8.0 as fixed releases and recommends upgrading to the corresponding branch. The status of other branches or packaging variants is not established by the supplied affected facts; do not infer that every parallel branch is safe from these two fixes alone.

The affected component is Calc's external data-link handling, specifically the calcext:data-mappings, SQL provider, and JDBC connector paths named by the vendor. An attacker-controlled document can name a Java database driver for an external data source and cause that driver to be loaded from a remote location. When the victim opens the document, Java code from that location can run. This is inclusion of functionality from an untrusted control sphere, consistent with CWE-829. The attack requires the document to reach the local system and the user to open it; the record does not require attacker authentication or prior privileges. The exact Java loading implementation, document-format restrictions, and sandbox or warning-dialog behavior are not established by the available evidence.

• Reachability: The record characterizes the attack as local because a crafted document must reach the target system and be opened in LibreOffice Calc.
• Authentication and privileges: The record does not require attacker authentication or prior privileges.
• User interaction: Passive user interaction is required. The user must open the document for driver loading and Java execution to occur.
• Complexity: The record describes low attack complexity and identifies no additional special conditions.
• Known status: The record sets public_exploit to false and does not set known_exploited; the available evidence therefore does not establish a public exploit or known exploitation, but this is not proof that unreported exploitation is impossible.

Java code from the remote location can execute on the system that opens the document, creating the possibility of reading, changing, or disrupting resources accessible to the LibreOffice process. The practical outcome depends on the user's privileges, operating-system controls, and any sandboxing or application-control mechanisms in place. The record describes high impact to the confidentiality, integrity, and availability of the local system, but does not establish impact extending to other systems. Sandbox behavior, confirmation prompts, and execution-environment limits are not provided.

Java code execution can run with the privileges of the LibreOffice process and may affect resources accessible to that user account. Possible consequences include loss of confidentiality, modification of data, or disruption on the workstation, depending on account privileges and available isolation controls. The operational risk is greatest in workflows that receive and open Calc documents from external or uncontrolled sources. The evidence does not confirm a breach, a named victim, or impact beyond the system running LibreOffice.

1. Upgrade by branch: apply LibreOffice 26.2.5 to the 26.2 branch and LibreOffice 26.8.0 to the 26.8 branch, using the releases confirmed by the vendor as fixed.
2. Until upgrading is possible, do not open untrusted Calc documents on deployments that remain affected. This is a precaution based on the documented trigger, not a vendor-confirmed workaround.
3. After upgrading, verify the installed release on workstations and recheck document-opening workflows to ensure that no deployment still uses an unfixed release.
4. Review business documents and templates that require external data links, particularly those using a Java database driver or JDBC connector, before returning them to normal workflows.

1. Inventory LibreOffice installations and identify systems still running an affected branch before the vendor-fixed release.
2. Review Calc documents stored or received from untrusted sources for external data links that use a Java database driver, JDBC connector, or SQL provider.
3. Check document-ingestion workflows, especially processes that automatically open Calc files or open them from download folders, shared folders, or email.
4. As a precaution, use endpoint monitoring to review whether LibreOffice opening an untrusted document is followed by unusual Java activity. This is defensive monitoring, not a vendor-confirmed IOC.
5. No specific log event, IOC, or dedicated detection signature is provided by the available evidence; absence of such evidence does not prove that a system is safe.