CVE-2026-63267

MediumCVSS 6.7/10Last modified Oct 6, 2026

Description

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.

Metrics

CVSS 4.0 6.7/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-200 CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-632686.7LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name CVE-2026-632696.7LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HL CVE-2026-63274.3IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special CVE-2026-632706.7URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated CVE-2026-632725.4LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that ca CVE-2026-632735.4LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption CVE-2026-632745.4LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken CVE-2026-632755.4LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The n CVE-2026-632765.4LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embe CVE-2026-632778.5LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java datab CVE-2026-632786.7URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated CVE-2026-632795.4LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a co