CVE-2026-63268

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the…

Risk score: 40/100
CVSS: 6.7 v4.0
Exploit chance (30 days): 0.1%
Published: 5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are rest…
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 6.7 medium

References

https://www.libreoffice.org/about-us/security/advisories/cve-2026-63268

Original description

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.

Last activity 5 Oct 2026. Patch Forecast updates every hour.