# CVE-2026-63277: LibreOffice Calc remote code execution via SQL provider and JDBC connector

Source: https://junglewise.ai/threats/cve-2026-63277-libreoffice-calc-can-link-a-cell-range-to-an-external-data-source  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-63277 · Severity: info · Published 2026-10-05

LibreOffice Calc is a spreadsheet application used for data analysis and document processing. The application allows linking cell ranges to external data sources, with these links saved in documents. An attacker can craft a malicious document that loads a Java database driver from a remote location, enabling arbitrary code execution when the document is opened.

Technologies: [LibreOffice Calc](https://junglewise.ai/threats/technologies/libreoffice-calc-1). Vendors: [LibreOffice](https://junglewise.ai/threats/vendors/libreoffice).

## Quick answers

**Is CVE-2026-63277 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63277 being exploited in the wild.

**How severe is CVE-2026-63277?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** LibreOffice Calc versions prior to 26.2.5 and 26.8.0.

**Is there a fix for CVE-2026-63277?** Yes: fixed in LibreOffice 26.2.5, 26.8.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63277 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-63277?** Check whether you run LibreOffice Calc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in LibreOffice 26.2.5, 26.8.0

## Technical details

LibreOffice Calc's external data-mapping feature via calcext:data-mappings with the SQL provider and JDBC connector allows loading Java database drivers from arbitrary URLs. When a document contains such a link, the Java driver is fetched and executed during document loading, requiring only that the user opens the document. The fix restricts Java class path entries to file URLs only.

## Affected products

- LibreOffice Calc versions prior to 26.2.5 and 26.8.0

## Timeline

- 2026-10-05: disclosed

## References

- [https://www.libreoffice.org/about-us/security/advisories/cve-2026-63277](https://www.libreoffice.org/about-us/security/advisories/cve-2026-63277)

## Related threats

- [LibreOffice Calc external CSV data link LFI and SSRF](https://junglewise.ai/threats/cve-2026-63267-libreoffice-calc-can-link-a-cell-range-to-an-external-csv-data)
- [LibreOffice Calc arbitrary file write via Firebird backup functionality](https://junglewise.ai/threats/cve-2026-63266-libreoffice-calc-can-link-a-cell-range-to-an-external-data-source)