CVE-2026-63277 The Document Foundation CVE debrief

Who should care

Defenders responsible for LibreOffice deployments, particularly those with exposure to untrusted documents or sources, should assess and remediate this vulnerability. This includes verifying and remediating LibreOffice installations, restricting access to untrusted documents, and monitoring for suspicious activity. Operators, platforms, vulnerability-management teams, and security teams should review the vulnerability and take necessary actions to prevent

Why it matters

CVE-2026-63277 allows remote Java code execution in LibreOffice Calc when opening documents with malicious links. Defenders should verify and remediate LibreOffice installations, restrict access to untrusted documents, and monitor for suspicious activity.

• Potential remote Java code execution when opening documents with malicious links
• Possible data breaches or unauthorized access through exploited documents
• Required verification of LibreOffice versions and configurations to prevent exploitation
• Need for updated threat intelligence and monitoring to detect potential attacks

Technical summary

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions, an entry in a Java class path has to be a file URL. This vulnerability affects LibreOffice deployments, particularly those with exposure to untrusted documents or sources. Defenders should assess and remediate this vulnerability to prevent potential Java code execution.

Defensive priority

Defenders should prioritize verifying and remediating LibreOffice installations to prevent potential Java code execution.

Recommended defensive actions

• Verify and remediate LibreOffice installations to prevent potential Java code execution
• Restrict access to untrusted documents and sources
• Monitor for suspicious activity and update LibreOffice to the latest version
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation steps is limited. The vulnerability allows remote Java code execution in LibreOffice Calc when opening documents with malicious links. Defenders should verify and remediate LibreOffice installations, restrict access to untrusted documents, and monitor for suspicious activity. The official CVE Program record and NVD detail page provide source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.