---
title: Tip: LibreOffice shops — jump to 26.2.5/26.8.0 and treat untrusted spreadsheets as untrusted code | ctxsec
url: https://ctxsec.com/items/tip-libreoffice-26-2-5
description: ""
status: "how-to"
published: 2026-10-17
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-libreoffice-26-2-5.md)

how-to

2026-10-17

### Tip: LibreOffice shops — jump to 26.2.5/26.8.0 and treat untrusted spreadsheets as untrusted code

If your org still ships LibreOffice below 26.2.5 (or 26.8.0 on the new branch), the Oct 5 Calc external-data-link bugs mean opening a spreadsheet can write files or pull remote content before the user clicks Update Links. Patch first. Until then: disable automatic link updates, open untrusted ODFs/XLSX in a sandbox or web viewer, and block inbound office docs that embed Firebird/JDBC/SQL data mappings. On the 25.8 branch, stay at or above 25.8.7 for the EMF+ brush overflow (CVE-2026-6045) that ZDI republished Oct 16.

Sources: [LibreOffice security advisories](https://www.libreoffice.org/about-us/security/advisories/)