Critical Vulnerability in LibreOffice and OpenOffice Allows Silent Code Execution via Spreadsheets

Security researchers have identified vulnerabilities in LibreOffice and Apache OpenOffice that enable malicious spreadsheets to execute arbitrary code upon opening without triggering macro security warnings. The exploit requires Java support to be enabled within the office applications and has currently only been demonstrated as a proof-of-concept with no confirmed real-world attacks. This vulnerability poses a significant risk to users who open untrusted spreadsheet files, as the attack bypasses the standard security mechanisms users rely on.

LibreOffice and Apache OpenOffice, widely-used open-source alternatives to commercial office software, contain security flaws that permit the execution of unauthorized programs through spreadsheet files. The vulnerability operates by circumventing the protective warnings that normally alert users when macros or executable content attempt to run, creating a silent attack vector.

The flaw depends on Java functionality being active within these applications. While researchers have demonstrated the concept's feasibility, there is currently no evidence of attackers exploiting this weakness in actual incidents. Users who handle spreadsheets from unknown or untrusted sources face the greatest exposure.