interesting · Documents — RCE
Opening a crafted Calc spreadsheet can make LibreOffice fetch and execute attacker-hosted Java code.
Affects
LibreOffice Calc, the spreadsheet application and headless document converter available across desktop and server platforms.
A saved external-data mapping can select the SQL provider and retrieve a remote JDBC driver during document loading; the driver’s code runs as the LibreOffice process.
Detail and 2 sources
The route crosses the document-to-code boundary for desktops and automated document pipelines, but it requires the file to be opened with LibreOffice Java support available.