The Document Foundation published a batch of LibreOffice advisories announced Oct 5, 2026, fixed in 26.2.5 and 26.8.0. The standout is CVE-2026-63266: a crafted Calc spreadsheet can persist an external-data link that opens an embedded Firebird database and writes a file to any location the user can write. Related CVEs in the same release cover LFI/SSRF via CSV and SQL data providers (CVE-2026-63267/63268), GStreamer HLS playlist LFI/SSRF (CVE-2026-63269), environment/INI leaks through URLs (CVE-2026-63270), and RCE via a remote JDBC driver in a Calc link (CVE-2026-63277). Separately, ZDI's Oct 16 coordinated releases cover older LibreOffice bugs including EMF+ brush integer overflow CVE-2026-6045 (fixed since 26.2.3/25.8.7) and PDF import overflows CVE-2026-63273/63274 (fixed in 26.2.5). No in-the-wild exploitation is claimed. Upgrade to >= 26.2.5 or >= 26.8.0 (and keep 25.8.7+ on the older branch for the June EMF+ fix).