CVE-2026-63277: CWE-829 Inclusion of Functionality from Untrusted Control Sphere in The Document Foundation LibreOffice

LibreOffice Calc allows linking a cell range to an external data source, saving the link in the document. An attacker could craft a document naming a Java database driver to be loaded from a remote location, resulting in execution of Java code from that location upon opening the document. The vulnerability is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The fix enforces that Java class path entries must be file URLs, blocking remote loading of Java code.

This vulnerability allows an attacker to execute arbitrary Java code from a remote location when a crafted document is opened in LibreOffice Calc. This could lead to high-impact consequences such as code execution with the privileges of the user opening the document. The CVSS 4.0 score is 8.5 (high), reflecting the potential for remote code execution with low attack complexity and no privileges required but user interaction needed.

No explicit patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check The Document Foundation's official advisory for current remediation guidance. The described fix requires Java class path entries to be file URLs, so updating to a version implementing this restriction is recommended once available. Until then, avoid opening untrusted documents that link to external data sources.