LibreOffice/OpenOffice PoC: Spreadsheets Execute Code, No Macro Warning

Tue, 06 Oct 2026 17:10:43 +0000

Engineer — Plan: If your environment runs LibreOffice or OpenOffice with Java support enabled, audit those deployments and disable Java as a mitigation now; monitor for a vendor patch and apply it promptly when released. No active exploitation yet, but the attack surface (malicious file opened by a user) is realistic.
SOC/IR — Learn: No active exploitation or published IOCs yet, so there is nothing actionable to hunt; worth tracking in case threat actors weaponize this for phishing lure campaigns delivering malicious spreadsheets.
Leader — Skip

Libreoffice on CuraSec