<![CDATA[LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings]]>

<![CDATA[LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings]]>Security researchers have demonstrated that a malicious spreadsheet can cause LibreOffice and Apache OpenOffice to execute an attacker's code the moment the file is opened. Unlike the macro warning dialog both suites normally display before running macro code, this execution path provides no warning at all.

The attack depends on the program's Java support being enabled — with Java disabled, the technique does not work. Researchers have so far only shown the attack as a proof of concept, and there are no reports of it being used in the wild.

Key points:

Affected software: LibreOffice and Apache OpenOffice
Trigger: opening a crafted spreadsheet
No macro warning is displayed before code execution
Java support must be enabled for the attack to succeed
Status: proof of concept only, no known in-the-wild exploitation

Until patches or official guidance arrive, the most practical step for affected users is to disable Java support in the office suite if it is not required for their workflow.

Source: The Hacker News

Does your organization rely on Java support in LibreOffice or OpenOffice, and would disabling it be feasible in your environment?

]]>https://xploitlk.com/topic/588/libreoffice-and-openoffice-flaws-let-malicious-spreadsheets-run-code-without-macro-warningsRSS for NodeTue, 27 Oct 2026 09:49:56 GMTTue, 06 Oct 2026 12:30:17 GMT60