Medium severity · published Oct 5, 2026
CVE-2026-63266
Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibreOffice · The Document Foundation
26.2 before < 26.2.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63266
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63266
www.libreoffice.org
https://www.libreoffice.org/about-us/security/advisories/cve-2026-63266
More from LibreOffice
8.5
CVE-2026-63277
RCE via calcext:data-mappings, sql provider and jdbc connector
7.8
CVE-2026-8357
Heap buffer overflow in Calc formula compilation
7.8
CVE-2026-4430
Heap Buffer Overflow in AgileEngine
7.3
CVE-2026-6040
Heap use-after-free in ODF number-format blank-width parsing
6.7
CVE-2026-63270
Environment/ini-file leaks