CVE-2026-63268

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.

CVSS 4.0

6.7CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

EPSS

0.1% chance of exploitation in the next 30 days; higher than 1% of CVEs (scores of 2026-10-25)

CWE

CWE-200

Published

2026-10-05

Modified

2026-10-06

Record from

the NVD, synced 2026-10-19

References

• https://www.libreoffice.org/about-us/security/advisories/cve-2026-63268

Check your stackJSON