LibreOffice Calc CVE-2026-63268

Exploitation requires the victim to open a crafted LibreOffice Calc document that embeds a saved external data link of the sql type naming a local folder of text files as a database; on vulnerable versions this link is automatically restored at document load, reading the targeted local text file into the sheet. Limiting factors: (1) user interaction is required - the victim must open the attacker-supplied document (UI:P); (2) the attacker must know or guess a valid local filesystem path to a sensitive text file on the victim's machine; (3) meaningful information disclosure requires a mechanism to return the populated sheet to the attacker, since the flaw itself only reads the file locally; (4) fixed versions eliminate the condition by restoring only csv, html, and xml data providers, so only pre-fix versions are exposed.

This is a medium-severity information disclosure flaw (CWE-200) in LibreOffice Calc, rated CVSS 6.7 by The Document Foundation using a CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N). The vector signals local attack vector, low complexity, and - critically - passive user interaction (UI:P), meaning a victim must open a crafted document for the saved sql-type external data link to be auto-restored and resolve a local folder of text files into the sheet. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied, so there is no evidence of active or at-scale exploitation; the realistic threat is a targeted spear-phishing style document delivery rather than mass exploitation. Two signals warrant caution. First, the vendor marked PR:L (authenticated/some privilege) yet the actual attack is a classic malicious-document scenario where the attacker needs no privileges and the victim supplies all the interaction - the PR:L choice appears conservative and should be verified against the vendor advisory. Second, VC:H/SC:H claims high confidentiality impact, but the description only states that a local text file is read into the sheet; actual disclosure to the attacker requires a separate exfiltration path (e.g., the victim re-sharing the document or a secondary outbound link), which materially lowers real-world impact. Net: a legitimate but not high-priority issue - patch in normal cycles, prioritize for users who routinely open untrusted spreadsheets.

An attacker emails a victim a LibreOffice Calc document that contains a saved external data link of the sql type pointing at a predictable local path (e.g., a folder of config or credential text files). When the victim opens the document on a vulnerable version, the link is automatically restored and the targeted local text file's contents are loaded into a cell range; the data can then be harvested if the document is returned, synced, or paired with an outbound link. No public exploit code has been identified at time of analysis.