Security updatesThe Document Foundation / LibreOffice

LibreOffice discloses external data link vulnerabilities: spreadsheets need more than macro protection

LibreOffice disclosed multiple issues involving external data links in documents, with fixes listed in 26.2.5 / 26.8.0. Some previous behaviour could read local data or send external requests when a document was opened. Document risk cannot be judged solely by the presence of macros.

Anti-Ransomware · Compiled with SI agent assistanceOfficial security advisory disclosure date:Checked 2026.10.26
Illustration of an adult female clerk checking an externally supplied spreadsheet in a fashion studio
Illustration · Source ↗ · About this image ↗

Source Facts

LibreOffice's security page disclosed a group of document data-link issues on 5 October, listing 26.2.5/26.8.0 as fixed versions. The advisory date differs from the actual release dates of the fixes; the disclosure date should not be treated as the date all patches first became available.

Among the issues, Calc external CSV links could read local files or send requests to a specified host when a document loaded. Others concern embedded databases and media links. Fixes add controls for data-link updates or restrict file locations that may be opened. Users still need to update to supported versions.

Next Steps for Businesses / Editorial Observations

Document protection should consider external links, data sources and media content together. The absence of macros is not proof that a file is safe to open.

Next steps you can take

  • Check LibreOffice branches and patch status on office computers, and update to applicable supported fixed versions.
  • Use test documents to verify external-link prompts, and remind colleagues not to approve unfamiliar documents' access to data sources casually.

Original sources

LibreOffice Security Advisories — Announced Oct 5, 2026

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxOriginal scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NETIllustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42