LibreOffice CVE-2026-63270

Exploitation requires the victim to open an attacker-supplied document in LibreOffice (passive user interaction, UI:P) and reaches the vulnerability through specific document-supplied URL paths that the CVE-2024-12426 fix did not cover: XForms instance data, and the Calc CSV and SQL data providers. The crafted URL must use an internal scheme that triggers environment-variable or INI-file value expansion. Limiting factors: the attack is local-vector (a malicious document must be delivered and opened), impact is confined to leaking environment/INI values (confidentiality only, no code execution or data modification), and fixed versions mitigate it by refusing internal-scheme URLs when the URL originates from the document. Unaffected if documents are opened only from trusted sources or on patched builds.

This is a moderate-severity information-disclosure flaw (CVSS 4.0 base 6.7, CWE-200) rather than a high-urgency, mass-exploitation threat. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) points to a local vector requiring the victim to open a malicious document (UI:P), with confidentiality-only impact extending to a subsequent system (SC:H) because data is exfiltrated to a remote server; there is no integrity or availability impact. No EPSS score, KEV listing, or POC indicator was provided in the input, so exploitation probability signals are absent - this is NOT in CISA KEV and no public exploit was identified at time of analysis. The practical attacker effort is non-trivial: a user must be socially engineered into opening a crafted document, and the payload only leaks environment-variable or INI values rather than granting code execution. One signal to flag explicitly: the vendor vector sets PR:L, but the described attack (opening an attacker-supplied document) normally requires no pre-existing privileges on the target - this PR:L assignment is questionable and my independent assessment uses PR:N/UI:R; verify with the LibreOffice advisory. Net priority: patch in normal cycles; it is a real information-leak bug but not a drop-everything issue absent any exploitation evidence.

An attacker emails a victim a LibreOffice document (e.g., a Calc spreadsheet using a CSV/SQL data provider or a form with XForms instance data) in which a URL references an internal scheme that expands environment variables or INI file values. When the victim opens the document, LibreOffice resolves the crafted URL and transmits the expanded sensitive values to an attacker-controlled remote server. No public exploit code was identified in the provided data, and the local vector plus required user interaction make this a targeted social-engineering attack rather than a remote mass-exploitation vector.