LibreOffice Calc CVE-2026-63267

Exploitation requires the victim to open an attacker-crafted Calc document in which a cell range is linked to an external CSV data source. On affected (pre-fix) versions this external data link was fetched automatically during document load, bypassing the standard link-update confirmation that governs other links - so no victim click beyond opening the file is needed. Limiting factors: the attack is local and interaction-gated (UI:P) - the attacker must deliver the malicious document and the victim must open it; it does not affect integrity or availability (VI:N/VA:N), and fixed versions neutralize it by placing external data links under the same link-update control as other links.

This is a moderate, user-interaction-gated information-disclosure/SSRF flaw rather than a top-priority emergency. The vendor CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:P/VC:H/SC:H) describes an attack that requires the victim to open an attacker-supplied spreadsheet, so there is no remote-unauthenticated mass-exploitation path; the high score is driven by the dual confidentiality impact (local file read on the victim system plus SSRF to an attacker-chosen host). No EPSS score, CISA KEV listing, or public POC was supplied in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' - this is a disclosed-and-patched vendor-reported issue, not one with evidence of active abuse. One conflict to verify: the vector sets PR:L (implying some privilege/authentication), yet opening a document normally requires no privileges - opening an untrusted file is a user-interaction event, not an authentication event, so PR:N/UI:R is arguably more accurate; verify the intended privilege model with the vendor advisory. Overall: patch in normal maintenance cadence, prioritized by the fact that LibreOffice is extremely widely deployed and malicious-document delivery (email/download) is a realistic social-engineering vector.

An attacker crafts a LibreOffice Calc spreadsheet containing a cell range linked to an external CSV data source and emails or shares it with a victim. When the victim opens the document, the affected version automatically fetches the external link - reading a local file path into the sheet (disclosing its contents back to a document the attacker may later recover) or issuing an HTTP request to an attacker-controlled host (SSRF/beaconing). No public exploit code was identified in the provided data, but crafting the malicious link is trivial and requires no special tooling.