CVE-2026-63266

NameCVE-2026-63266
DescriptionLibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6543-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libreoffice (PTS)bookworm4:7.4.7-1+deb12u14vulnerable
bookworm (security)4:7.4.7-1+deb12u13vulnerable
trixie4:25.2.3-2+deb13u6vulnerable
trixie (security)4:25.2.3-2+deb13u8fixed
forky4:26.8.0.3-2fixed
sid4:26.8.1.1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libreofficesourcetrixie4:25.2.3-2+deb13u8DSA-6543-1
libreofficesource(unstable)4:26.2.5.2-1

Notes

https://www.libreoffice.org/security/#cve-2026-63266
Search for package or bug name: Reporting problems