Vulnerability · Published Oct 5, 2026 · Assigned by Document Fdn.
CVE-2026-63268LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href
Medium 6.7
In plain English
A medium-severity information exposure in LibreOffice from The Document Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libreoffice | no fix listed | DEBIAN-CVE-2026-63268 |
| Debian:13 | libreoffice | 4:25.2.3-2+deb13u8 | DEBIAN-CVE-2026-63268 |
| Debian:14 | libreoffice | 4:26.2.5.2-1 | DEBIAN-CVE-2026-63268 |
| Ubuntu:22.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63268 |
| Ubuntu:24.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63268 |
| Ubuntu:26.04:LTS | libreoffice | no fix listed | UBUNTU-CVE-2026-63268 |
| Ubuntu:26.10 | libreoffice | no fix listed | UBUNTU-CVE-2026-63268 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Document Foundation | LibreOffice | 26.2 – before < 26.2.5 |
Weakness: CWE-200 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N