Published on DigitalSpying.com | October 7, 2026
Author: DigitalSpying Threat Research Team
Threat Classification: Open-Source Software Vulnerability | Remote Code Execution | Macr
o Security Bypass
Executive Summary
For decades, document-based social engineering has followed a predictable pattern: malicious actors distribute weaponized Word or Excel files and rely on deceptive lures to persuade victims to click "Enable Macros" or "Enable Content." Security awareness training programs across the globe have conditioned users to treat macro prompts as immediate red flags. However, a pair of critical vulnerabilities discovered in the world's most widely deployed open-source office suites has bypassed this fundamental defensive barrier entirely.
In technical advisories reported by The Hacker News, ThaiCERT, CISO Series, and CyberKendra, security researchers demonstrated a silent Remote Code Execution (RCE) vector impacting LibreOffice Calc (CVE-2026-63277) and Apache OpenOffice Calc (CVE-2026-59265). By exploiting spreadsheet database range link features, an attacker can craft a spreadsheet that silently downloads and executes malicious Java code from a remote server without displaying a single macro warning or security confirmation dialog.
Technical Deep-Dive: Deconstructing the JDBC Driver Exploit
1. The Vulnerable Mechanism: Calc Database Ranges
In both LibreOffice Calc and Apache OpenOffice Calc, spreadsheets support an advanced data integration feature known as "Database Ranges" (Data > Define Range):
* External Data Linking: A block of cells can be bound to external relational databases, text files, or OpenDocument Base (.odb) documents to allow dynamic spreadsheet refreshes.
* Java Database Connectivity (JDBC): To connect to diverse database engines (such as MySQL, PostgreSQL, or Oracle), the office suites integrate with the system’s Java Runtime Environment (JRE), loading third-party JDBC driver classes packaged in Java Archive (.jar) files.
[Target Opens Malicious .ods Spreadsheet]
│
│ 1. Document Loaded in LibreOffice / OpenOffice Calc
▼
[Calc Resolves Embedded "Database Range" Configuration]
│
│ 2. Initiates Automated Link to External .odb File over HTTP
▼
[External Database Configuration Ingested]
│
│ 3. Directs Calc to Load Remote JDBC Driver JAR File
▼
[Java Runtime Integration (JRE)]
│
│ 4. Downloads Remote JAR & Dynamically Loads Java Class via Reflection
▼
[ZERO MACRO WARNINGS TRIGGERED! NO SECURITY DIALOGS!]
│
│ 5. Malicious Static Initializer in JAR Executes Arbitrary Bytecode
▼
[Immediate Remote Code Execution on Host OS (Windows / Linux)]
2. The Exploit Chain: Weaponizing Remote JAR Reflection
The vulnerability stems from the office suites' unconstrained willingness to download and load remote Java bytecode during document rendering:
1. The Staged Database Container: The attacker creates a weaponized .ods spreadsheet that embeds a reference to a database source hosted on an external server (e.g., http://attacker-c2.com/payload.odb).
2. Remote Driver Specification: Inside the .odb configuration, the attacker configures the database connection properties to use a custom JDBC driver class (e.g., com.attacker.MaliciousDriver) and specifies a remote URL pointing to a malicious .jar archive.
3. The Silent Execution Trigger: When the victim opens the spreadsheet:
* If Java support is enabled (the default configuration across many enterprise Linux distributions and developer workstations), Calc’s document parser automatically resolves the external database range.
* It issues an outbound HTTP request to retrieve the .odb container, extracts the driver class path, and invokes the JVM classloader to fetch and instantiate the remote JAR.
4. The Bypassed Defense: Because the code is executed via the underlying Java database connectivity layer rather than the internal StarOffice/VBA Basic macro engine, the software’s macro execution guardrails are never invoked. The user sees only a standard spreadsheet loading screen, while arbitrary Java code executes silently in the background with the privileges of the logged-in user.
3. Cross-Platform Efficacy
Researchers confirmed that the proof-of-concept operates reliably across both Windows and Linux environments:
* On Linux, where LibreOffice is the standard default office suite across distributions like Ubuntu, Debian, and Fedora, the exploit achieves immediate shell access (/bin/sh).
* On Windows, the Java payload can spawn PowerShell stagers, drop memory-resident implants, and communicate with command-and-control servers.
The Patch Disparity: LibreOffice Remediated, OpenOffice Still Exposed
A critical element of this disclosure is the widening security divide between LibreOffice and Apache OpenOffice:
* LibreOffice's Immediate Response: The Document Foundation acted rapidly, patching CVE-2026-63277 in maintenance releases LibreOffice 26.2.5 and LibreOffice 26.8.0 on October 5, 2026. The patch introduces strict protocol filtering, completely prohibiting the dynamic loading of JDBC driver classes from untrusted remote URLs.
* Apache OpenOffice Exposure: In contrast, Apache OpenOffice remains vulnerable across all production builds up to and including version 4.1.16. A patch addressing CVE-2026-59265 is currently restricted to Release Candidate builds (version 4.1.17) and has not yet been rolled out to stable distribution channels, leaving millions of legacy OpenOffice users exposed.
Mitigation & Enterprise Hardening Blueprint
Organizations deploying open-source office suites must immediately enforce the following safeguards:
1. Upgrade LibreOffice Instantly
Ensure all employee workstations running LibreOffice are upgraded to:
* LibreOffice 26.2.5 or higher
* LibreOffice 26.8.0 or higher
2. Emergency Workaround for Apache OpenOffice: Disable Java
Because Apache OpenOffice currently lacks a general-availability security patch:
* Disable Java Runtime Integration: In the OpenOffice menu, navigate to:
Tools > Options > OpenOffice > JavaUncheck the optio
n "Use a Java runtime environment".
* Disabling the JRE integration completely neutralizes the JDBC classloading vector while preserving core word processing and spreadsheet calculation capabilities.
3. Email Gateway and Attachment Inspection
* Configure Secure Email Gateways (SEGs) to inspect inbound OpenDocument Spreadsheet (.ods) and OpenDocument Text (.odt) files.
* Quarantine or strip documents containing external database connections, XML tags linking to .odb schemas, or external HTTP/HTTPS JDBC driver references.
4. Host-Level Java Egress Filtering
* Enforce host-based firewall policies that strictly prohibit Java processes (java.exe, javaw.exe, /usr/bin/java) from establishing arbitrary outbound network connections to external internet IP addresses.
References & Official Advisories
* The Hacker News: LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings
* ThaiCERT Security Advisory: Vulnerabilities in LibreOffice and OpenOffice Calc
* CISO Series Security Bulletin
* CyberKendra Threat Report: LibreOffice, OpenOffice Hit by Spreadsheet RCE via JDBC