CVE-2026-63266

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.

Credits

Thomas Rinsma and Edoardo Geraci from Codean Labs
Caolán McNamara of Collabora Productivity

References