LibreOffice Calc CVE-2026-63266

Exploitation requires the victim to open, in LibreOffice Calc, a crafted document that defines an external data-source link bound to an embedded Firebird database; processing that link triggers the file write. The attack is limited by requiring user interaction (opening the malicious spreadsheet, UI:P) and by a local delivery vector (AV:L) - the attacker must get the document onto and opened on the victim's machine. The write primitive is further constrained to filesystem locations the invoking user already has write permission to; it does not escalate privileges by itself. Vulnerable (unpatched) versions are affected by default; fixed versions restrict the embedded Firebird engine to its own private directory, neutralizing the arbitrary-path write.

This is a moderate-severity, user-interaction-dependent file-write vulnerability rather than a high-priority remote threat. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N, 6.8) is internally consistent with the description: exploitation is local (AV:L) because a victim must open a malicious document, requires passive user interaction (UI:P), needs no prior authentication (PR:N), and yields a high integrity impact (VI:H) via arbitrary file writing while causing no confidentiality or availability loss (VC:N/VA:N). No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active or probable exploitation - the signals are not conflicting, they are simply absent. The practical risk is bounded by two factors: the attacker gains only write primitive (not direct code execution) limited to paths the invoking user can already write to, and exploitation requires social engineering to get the victim to open a crafted spreadsheet. Note the single reference is a vendor advisory URL that was not retrievable here, so exact fixed version numbers are not confirmed from the input. Overall: a legitimate bug worth patching on a normal cycle, but not an emergency absent evidence of in-the-wild use.

An attacker emails a victim a crafted LibreOffice Calc spreadsheet containing an external data-source link that points to an embedded Firebird database. When the victim opens the document and the link is processed, the embedded Firebird engine writes an attacker-controlled file to an arbitrary location writable by the victim's user account (e.g., a startup script or config file), potentially leading to later code execution. No public exploit code was identified at time of analysis.