LibreOffice and OpenOffice Vulnerabilities Allow Silent Code Execution in Spreadsheets
Security researchers demonstrated that malicious spreadsheets can trigger code execution in LibreOffice and Apache OpenOffice without displaying standard macro warnings.
Key points
- The flaw allows code to run immediately upon opening a file, bypassing security prompts.
- The attack vector requires the application's Java support feature to be enabled.
- Researchers have only released a proof-of-concept; no real-world exploitation has been reported.
Security researchers have demonstrated a vulnerability in both LibreOffice and Apache OpenOffice that allows malicious spreadsheets to execute attacker-controlled code without triggering the standard macro warning dialog. The exploit functions as soon as the infected file is opened by the user, according to a report by The Hacker News.
This bypass eliminates the primary defense mechanism these applications provide against unauthorized macro execution. Typically, users are presented with a clear warning before any embedded code runs, allowing them to cancel the action. In this scenario, the code executes silently in the background. The researchers emphasized that this specific attack vector is conditional; it only works if the user has enabled Java support within the office suite settings. If Java is disabled, the exploit cannot be triggered through this method.
Proof of Concept Status
The discovery is currently limited to a proof-of-concept demonstration. There are no confirmed reports of threat actors using this technique in active cyberattacks or in the wild. The researchers published their findings to alert the security community and the vendors before any malicious campaigns could emerge. Because the exploit relies on a specific configuration—enabled Java support—the immediate risk is contained to users who have explicitly turned on this feature.
The lack of a warning dialog is the critical aspect of this finding. Macro warnings are a standard security control in office productivity software, designed to give users a final chance to reject suspicious files. By circumventing this prompt, an attacker gains a higher probability of successful infection, particularly in environments where users may be accustomed to clicking through standard warnings without reading them carefully.
Affected Software and Users
Both LibreOffice and Apache OpenOffice are affected by this flaw. These are widely used open-source alternatives to proprietary office suites, popular among organizations seeking to reduce licensing costs and among individual users who prefer open-source software. The vulnerability affects the spreadsheet component of these suites.
Users who rely on Java-enabled features for complex calculations, integrations, or legacy compatibility are the primary audience for this risk. However, many default installations or security-hardened configurations may disable Java support by default, which would mitigate this specific attack vector. Organizations using these suites should verify their current Java settings and assess whether the feature is necessary for their operational workflows.
What should you do?
As of this report, no patch or security update has been confirmed by the vendors to address this specific bypass. Users should monitor official channels from The Document Foundation (LibreOffice) and the Apache Software Foundation (OpenOffice) for upcoming advisories. Until a fix is available, the most effective mitigation is to disable Java support if it is not strictly required for daily tasks.
What to do and how to stay safe: LibreOffice
- Disable Java support in LibreOffice and Apache OpenOffice settings if your workflow does not require Java-based features.
- Monitor official vendor channels for security advisories and patches related to macro execution and Java integration.
- Treat spreadsheet files from unknown or untrusted sources with extreme caution, even if no warning appears.
- Verify that your office suite is updated to the latest available version to ensure protection against other known vulnerabilities.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect Microsoft Excel or Google Sheets?
No, the report specifically identifies LibreOffice and Apache OpenOffice as the affected applications.
Will the code run if I have Java support disabled?
No, the researchers stated that the attack works only when the program's Java support is enabled.
Is there a patch available to fix this issue?
No, the source material indicates this is a proof-of-concept and does not mention an available fix or update.
