Can Just Opening a Spreadsheet Run Malicious Code? The LibreOffice and OpenOffice Java Flaw, Explained
Researchers showed a booby-trapped spreadsheet can make LibreOffice or Apache OpenOffice run attacker code on open, with no macro warning, when Java is enabled. LibreOffice is fixed; OpenOffice is not yet.
Most people know to be careful with spreadsheets that ask to enable macros. Researchers have now shown a way for a spreadsheet to run code in LibreOffice and Apache OpenOffice with no such prompt at all. Here are the practical questions and answers.
What did the researchers find?
A malicious spreadsheet can make either program run an attacker’s code as soon as the file is opened, without the warning the programs normally show before running a macro.
Is everyone affected?
No. The attack works only when the program’s Java support is turned on. It has been tested on Windows and Linux, and the researchers say it does not depend on a particular operating system.
How does it work without a macro?
It strings together normal features. A Calc spreadsheet can contain a “database range,” a block of cells that pulls data from an outside source and refreshes automatically. That source can be a separate database file (an ODB) located at a web address written into the spreadsheet. When the file opens, the range refreshes and downloads the ODB. The ODB can name a Java database driver (a JDBC driver) and say where its code lives, including a JAR file on a remote server. The program fetches the JAR and starts the driver, which is really the attacker’s code, inside the office suite. No step on its own is a bug. Together, they reach code execution without ever asking the user to trust the document.
Is it being used in real attacks?
Not so far. It has been demonstrated only as a proof of concept, in which the driver simply opened the Calculator app as a harmless stand-in. The researchers note that the same path can run any Java code an attacker wants, and that a real attack would host the database file and code on an attacker-controlled server.
Is there a fix?
- LibreOffice: Fixed as CVE-2026-63277 in updates released October 5. Move to version 26.2.5 or 26.8.0; earlier versions are affected. Caolán McNamara of Collabora Productivity wrote the fix.
- Apache OpenOffice: Not yet. The matching flaw, CVE-2026-59265, affects every version through the current 4.1.16. A fix is expected in 4.1.17, which is still in testing.
What can OpenOffice users do in the meantime?
Turn off Java in the program’s settings, or don’t open spreadsheets from sources you don’t trust.
Who found it?
For LibreOffice, Rick de Jager of the V12 security team and, independently, Thomas Rinsma and Edoardo Geraci of Codean Labs. Apache credits Codean Labs for the OpenOffice flaw. The V12 team has published a proof of concept for both programs.
Swati Khandelwal explained the research in detail at The Hacker News.
What this means for your company
- Find every office suite in use. Free suites often get installed without IT knowing. Check for LibreOffice and OpenOffice on company machines.
- Update or disable Java. Bring LibreOffice to a fixed version. Where OpenOffice remains, turn off Java support until 4.1.17 ships, or consider replacing it.
- Don’t rely on macro warnings alone. Teach staff that any unexpected spreadsheet can be risky, prompt or no prompt.
- Remove Java where it isn’t needed. Fewer runtimes on a machine means fewer paths like this one.
Need help inventorying and securing the desktop software across your company? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
