CVE-2026-63277 — RCE via calcext:data-mappings, sql provider and jdbc connector
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be load…
Published: 2026-10-05 · CVSS: 8.5 · CVSS 4.0
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7