LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro. The attack works only when the program's Java support is enabled. So far, it has only been shown as a proof of concept, and there are no reports of its use in

Researchers demonstrated that specially crafted spreadsheets can execute attacker code when opened in LibreOffice or Apache OpenOffice without triggering macro warnings; the attack requires Java support to be enabled. LibreOffice fixed its tracked flaw in versions 26.2.5 and 26.8.0, while the corresponding OpenOffice issue remained unpatched in the reported versions, and exploitation was described as proof of concept with no reported real-world use. RealGround analysis: although the report is not AI-specific, the affected open-source office components may exist in environments supporting AI workflows, making dependency inventory, patch tracking, and safe document-handling controls relevant supply-chain measures.