Security researchers have demonstrated a proof-of-concept attack that could allow a malicious spreadsheet to run code in LibreOffice and Apache OpenOffice as soon as the file is opened. According to the reported findings, the attack can bypass the macro warning prompts users would normally expect before active content is executed.

The reported technique only works when Java support is enabled in the office suite. There are currently no reports of the method being used in real-world attacks, but the disclosure is still relevant for businesses that exchange spreadsheet files with customers, suppliers, partners or internal teams.

What happened

Researchers showed that specially crafted spreadsheet files could cause LibreOffice and Apache OpenOffice to execute attacker-controlled code on opening, without first displaying the standard macro security warning.

Based on the published report, this has been demonstrated as a proof of concept rather than as an active campaign. The available information also indicates that the attack requires Java support to be enabled in the affected software.

That distinction matters: this is not the same as a confirmed widespread exploitation case. However, proof-of-concept disclosures often give defenders an early signal to review configuration settings and user exposure before attacks appear in the wild.

Why it matters for European businesses

Spreadsheet files remain a routine part of business operations across finance, procurement, logistics, HR and sales. Many organisations treat macro warnings as a key sign that a file may be dangerous. If a technique can execute code without that expected warning, users may have fewer visual clues that something is wrong.

For European SMEs, the practical risk is highest where staff regularly open office documents received by email or downloaded from portals and third parties. Open-source office suites are common in cost-conscious environments, educational organisations, public-sector suppliers and businesses with mixed desktop environments.

Even without confirmed abuse, the issue highlights a broader security lesson: document-based attacks are not limited to Microsoft Office macros. Businesses should account for the security settings, plugin dependencies and active-content behaviour of every office application in use.

Who may be affected

• SMEs using LibreOffice or Apache OpenOffice on employee workstations
• Finance, operations and administration teams that frequently open spreadsheets from outside the organisation
• IT teams managing Linux or mixed-device office environments where open-source office suites are deployed
• Suppliers to public-sector or education clients where these office tools may be more common
• Organisations with Java enabled in their office suite configuration

What companies should consider

• Review whether Java support is enabled in LibreOffice or OpenOffice installations and assess whether it is actually required for business workflows.
• Check for vendor advisories and updates from LibreOffice and Apache OpenOffice, and apply patches or mitigation guidance when available.
• Limit the opening of untrusted spreadsheets received by email, file-sharing links or external contacts, especially on machines with broad user permissions.
• Update user awareness guidance so employees understand that the absence of a macro warning does not guarantee a spreadsheet is safe.
• Use endpoint protection and application controls to reduce the impact if a document attempts to launch code on a workstation.
• Isolate higher-risk document handling for teams that process large numbers of external files, such as finance or procurement.

At this stage, the reported issue should be treated as a credible security warning rather than evidence of active mass exploitation. For businesses using LibreOffice or OpenOffice, especially with Java enabled, it is a sensible time to review configurations, patching processes and document-handling controls.