---
title: LibreOffice 26.2.5/26.8.0: Calc external-data links could write arbitrary files or run Java (CVE-2026-63266 and kin) | ctxsec
url: https://ctxsec.com/items/libreoffice-oct-2026-calc-links
description: ""
status: "confirmed (LibreOffice TDF)"
published: 2026-10-05
---

> 

[← Cybersecurity News](/news) · [markdown](/items/libreoffice-oct-2026-calc-links.md)

confirmed (LibreOffice TDF)

2026-10-05

### LibreOffice 26.2.5/26.8.0: Calc external-data links could write arbitrary files or run Java (CVE-2026-63266 and kin)

The Document Foundation published a batch of LibreOffice advisories announced Oct 5, 2026, fixed in 26.2.5 and 26.8.0. The standout is CVE-2026-63266: a crafted Calc spreadsheet can persist an external-data link that opens an embedded Firebird database and writes a file to any location the user can write. Related CVEs in the same release cover LFI/SSRF via CSV and SQL data providers (CVE-2026-63267/63268), GStreamer HLS playlist LFI/SSRF (CVE-2026-63269), environment/INI leaks through URLs (CVE-2026-63270), and RCE via a remote JDBC driver in a Calc link (CVE-2026-63277). Separately, ZDI's Oct 16 coordinated releases cover older LibreOffice bugs including EMF+ brush integer overflow CVE-2026-6045 (fixed since 26.2.3/25.8.7) and PDF import overflows CVE-2026-63273/63274 (fixed in 26.2.5). No in-the-wild exploitation is claimed. Upgrade to >= 26.2.5 or >= 26.8.0 (and keep 25.8.7+ on the older branch for the June EMF+ fix).

Sources: [LibreOffice security advisories](https://www.libreoffice.org/about-us/security/advisories/) · [LibreOffice CVE-2026-63266](https://www.libreoffice.org/about-us/security/advisories/cve-2026-63266/) · [ZDI-26-781 (CVE-2026-6045)](https://www.zerodayinitiative.com/advisories/ZDI-26-781/)