# CVE-2026-63266: LibreOffice Calc arbitrary file write via Firebird backup functionality

Source: https://junglewise.ai/threats/cve-2026-63266-libreoffice-calc-can-link-a-cell-range-to-an-external-data-source  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-63266 · Severity: info · Published 2026-10-05

LibreOffice Calc allows users to link spreadsheet cell ranges to external data sources through embedded Firebird databases. A malicious spreadsheet document could exploit this feature to write files to any location on the user's system that they have write access to, potentially overwriting critical files or installing malware. Opening a crafted document is enough to trigger the vulnerability.

Technologies: [LibreOffice Calc](https://junglewise.ai/threats/technologies/libreoffice-calc-1). Vendors: [LibreOffice](https://junglewise.ai/threats/vendors/libreoffice).

## Quick answers

**Is CVE-2026-63266 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63266 being exploited in the wild.

**How severe is CVE-2026-63266?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** LibreOffice Calc before 26.2.5 and before 26.8.0.

**Is there a fix for CVE-2026-63266?** Yes: fixed in LibreOffice 26.2.5, 26.8.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63266 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-63266?** Check whether you run LibreOffice Calc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in LibreOffice 26.2.5, 26.8.0

## Technical details

The vulnerability exists in LibreOffice Calc's data-mapping feature (calcext:data-mappings) when combined with the Firebird database provider. Embedded Firebird databases could open or create files outside their private directory through backup functionality. The attack requires a user to open a malicious document; no authentication or special interaction is needed beyond opening the file.

## Affected products

- LibreOffice Calc before 26.2.5 and before 26.8.0

## Timeline

- 2026-10-05: disclosed
- 2026-10-05: patched

## References

- [https://www.libreoffice.org/about-us/security/advisories/cve-2026-63266](https://www.libreoffice.org/about-us/security/advisories/cve-2026-63266)

## Related threats

- [LibreOffice Calc remote code execution via SQL provider and JDBC connector](https://junglewise.ai/threats/cve-2026-63277-libreoffice-calc-can-link-a-cell-range-to-an-external-data-source)
- [LibreOffice Calc external CSV data link LFI and SSRF](https://junglewise.ai/threats/cve-2026-63267-libreoffice-calc-can-link-a-cell-range-to-an-external-csv-data)