{"id":244984,"date":"2026-10-06T22:05:14","date_gmt":"2026-10-07T03:05:14","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/10\/libreoffice-and-openoffice-flaws-let-malicious-spreadsheets-run-code-without-macro-warnings"},"modified":"2026-10-06T22:05:14","modified_gmt":"2026-10-07T03:05:14","slug":"libreoffice-and-openoffice-flaws-let-malicious-spreadsheets-run-code-without-macro-warnings","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/10\/libreoffice-and-openoffice-flaws-let-malicious-spreadsheets-run-code-without-macro-warnings","title":{"rendered":"LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/libreoffice-and-openoffice-flaws-let-malicious-spreadsheets-run-code-without-macro-warnings.webp\"><\/a><\/p>\n<p>A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker\u2019s code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro.<\/p>\n<p>The attack works only when the program\u2019s Java support is enabled. So far, it has only been shown as a proof of concept, and there are no reports of its use in real attacks.<\/p>\n<p>LibreOffice has already <a href=\"https:\/\/www.libreoffice.org\/security\/\" target=\"_blank\">fixed the flaw<\/a>, which it tracks as CVE-2026\u201363277, in updates released on October 5. It recommends that users move to version 26.2.5 or 26.8.0. Versions before those are affected.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker\u2019s code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro. The attack works only when the program\u2019s Java support is enabled. So far, it has [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1492],"tags":[],"class_list":["post-244984","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244984","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=244984"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244984\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=244984"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=244984"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=244984"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}