4 mentions in 7 days · 4 in 30 days · 5 total · first seen · last
A mailing-list reply asks if OpenOffice takeover bug CVE-2026-59265 also affects LibreOffice.
On the oss-security list, Demi Marie Obenour asked whether CVE-2026-59265, described as system takeover by opening a malicious Apache OpenOffice document, also applies to LibreOffice. The message adds no technical details, affected versions, patch status, or evidence of exploitation.
The Document Foundation says LibreOffice will not add generative AI, keeping documents on-device.
The Document Foundation said LibreOffice will not add generative AI to its default installation for the foreseeable future. The nonprofit, whose software is used by tens of millions of people, said documents must not be uploaded for remote processing and the suite must function without a network connection. Users who want AI can install extensions that connect the editor to local models. It said no current integration meets requirements such as on-device data and no reliance on a single AI provider.
LibreOffice patched spreadsheet code execution; matching OpenOffice flaw CVE-2026-59265 remains unfixed.
Researchers showed that opening a Calc spreadsheet can refresh a database range, download an ODB file, and load an attacker-controlled JDBC driver, running Java code without a macro warning when Java support is enabled. LibreOffice fixed CVE-2026-63277 in versions 26.2.5 and 26.8.0 on October 5. Apache OpenOffice CVE-2026-59265 is unpatched through 4.1.16, with a fix expected in 4.1.17. V12 published proof-of-concept files, and there are no reports of in-the-wild use.
Ubuntu's USN-8868-1 fixes LibreOffice flaws that could crash the app or execute code.
Ubuntu security notice USN-8868-1 says LibreOffice mishandled several document inputs in ways that could crash the application or allow arbitrary code execution. CVE-2026-63272 concerns WMF image imports. CVE-2026-63273 and CVE-2026-63274 concern PDF document imports. The notice also says embedded CFF fonts were handled incorrectly, with the same possible crash or code-execution impact. The text does not report exploitation in the wild.
OpenAI's Codex desktop app bundles 1.7GB of runtimes including full Python, Node.js, Poppler, git, and LibreOffice binaries.
Blogger Simon Willison found that the OpenAI Codex desktop app (since rebranded to ChatGPT) keeps about 1.7GB in a ~/.cache/codex-runtimes/codex-primary-runtime folder, including full Python and Node.js installations plus native binaries for Poppler, git, and the LibreOffice office suite. Bundled skills in the plugins directory instruct Codex on how to find and use these binaries. The observation highlights the heavyweight local runtime stack shipped with agentic coding tools.