LibreOffice Spreadsheet Flaw: What Indian Offices Must Do

In short: In early October 2026, LibreOffice and Apache OpenOffice disclosed a flaw that lets a crafted spreadsheet run Java code when it is opened, without the usual macro warning. LibreOffice has released fixed versions. OpenOffice has no fixed build yet. Offices should update LibreOffice, disable Java integration where it is not needed and treat unknown spreadsheets with care.

What Happened

On 5 October 2026, The Document Foundation published a security advisory for LibreOffice covering CVE-2026-63277, a flaw in the Calc spreadsheet application. Apache OpenOffice has an advisory for the same issue under CVE-2026-59265, which it rates as critical with the title "Opening a malicious document can lead to system takeover". Both advisories are listed on the official LibreOffice security page and the Apache OpenOffice advisory page.

According to reports by eSecurity Planet (7 October 2026) and Cyber Kendra (5 October 2026), the attack works like this: a crafted spreadsheet contains an external data range that points to a remote database file. That file tells the office suite to load a Java database driver from an address controlled by the attacker. When the document opens, the driver is downloaded and its code runs, and no macro prompt appears.

The researchers credited in the advisories are Rick de Jager of V12 Security, and Thomas Rinsma and Edoardo Geraci of Codean Labs, who reported the issue independently. A public proof of concept exists. As of the reports we checked, exploitation in the wild has not been confirmed.

Who Is Affected

• LibreOffice users on versions before the fixed releases. The fix is in LibreOffice 26.2.5 and 26.8.0.
• Apache OpenOffice users on version 4.1.16 and older. The Apache advisory says the fix will come in version 4.1.17, which was still at release candidate stage when the advisory was written.
• The attack needs Java integration to be installed and enabled in the office suite. This is not the default everywhere, but reports note it is common, especially on Linux desktops that have the database and Java packages installed.

Many offices, schools and government departments use LibreOffice or OpenOffice because they are free and work well with open document formats. Any organisation where staff open spreadsheets received by email, WhatsApp or download should treat this as a priority.

What It Means for Indian Businesses and Departments

Spreadsheets move constantly between departments, vendors and citizens: tender sheets, price lists, attendance records, MIS reports. Staff are trained to be careful with macros, and this flaw removes that warning. A single opened file could give an attacker a foothold on a desktop that also has access to shared drives, email and internal portals.

The fix is simple, but it must actually reach every machine. In many offices, office suites are installed once and never updated. That is the real risk here. Our guide to building a patch management process explains how to make updates routine rather than reactive.

What to Do Now

1. Find every installation. List all computers with LibreOffice or Apache OpenOffice and note the version, using your asset inventory or endpoint management tool.
2. Update LibreOffice. Move all LibreOffice installations to version 26.2.5, 26.8.0 or later, starting with machines that handle external files such as procurement, accounts and front office.
3. Disable Java integration in OpenOffice. Until version 4.1.17 is released, follow the Apache advice: go to Tools > Options > OpenOffice > Java and clear "Use a Java runtime environment".
4. Turn off Java where it is not needed. In LibreOffice, Java is controlled under Tools > Options > LibreOffice > Advanced. If your staff do not use database features that need Java, disable it and remove unused Java runtimes.
5. Warn staff about unknown spreadsheets. Send a short notice asking staff not to open spreadsheets from unknown senders and to report unexpected files to IT.
6. Watch for unusual activity. Ask your security team or provider to look for office applications making unexpected outbound connections or starting Java processes.

If you suspect a system has already been compromised, isolate it and follow your incident response plan. Organisations covered by CERT-In directions should also review their reporting duties; our CERT-In 6-hour reporting checklist summarises them. Please check specific obligations with your own adviser.

Frequently Asked Questions

Is Microsoft Excel affected by this flaw?

The advisories cover LibreOffice and Apache OpenOffice only. They do not mention Microsoft Excel.

Do macro security settings protect us?

No. Reports say the code runs through the external data and Java driver feature, so no macro warning appears. Updating and disabling Java integration are the protections.

Has this been used in real attacks?

As of the reports we reviewed, exploitation in the wild was not confirmed, but a public proof of concept exists, so organisations should not wait.

How Affix Center Can Help

Affix Center is a Mumbai-based IT company that helps businesses and government departments keep desktops patched and secure. Our IT operations team can inventory software across your offices and roll out updates, and our cybersecurity team can review endpoint settings and monitoring. Staff awareness matters too, as covered in our guide to phishing awareness training.

If you need help checking and updating office software across your organisation, contact Affix Center.