CVE-2026-63266

MediumCVSS 6.8/10Last modified Oct 6, 2026

Description

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.

Metrics

CVSS 4.0 6.8/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-632676.7LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while CVE-2026-632686.7LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name CVE-2026-632696.7LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HL CVE-2026-63274.3IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special CVE-2026-632706.7URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated CVE-2026-632725.4LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that ca CVE-2026-632735.4LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption CVE-2026-632745.4LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken CVE-2026-632755.4LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The n CVE-2026-632765.4LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embe CVE-2026-632778.5LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java datab CVE-2026-632786.7URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated