Should you update to LibreOffice 26.2.5?
No: install LibreOffice 26.2.6 instead. LibreOffice 26.2.5 is a security update The Document Foundation released on 21 Sep 2026 for Mac, Windows and Linux. It fixes 13 security flaws.[1] None of them is known to be used in attacks.
It has since been replaced by LibreOffice 26.2.6, released 5 Nov 2026, which includes all of its fixes. If you’re on an older version, install that instead.
Should you update?
No: install LibreOffice 26.2.6 instead. LibreOffice 26.2.6 came out on 5 Nov 2026 and includes every fix in LibreOffice 26.2.5, so there’s no reason to stop at this one. Software Update offers the newest version your device can run.
Is LibreOffice 26.2.5 still safe?
Not any more. LibreOffice 26.2.6 fixes 1 security flaw that LibreOffice 26.2.5 doesn’t, and each became public the day its fix shipped. Installing it is safe: get it only from libreoffice.org/download, never from a link in an email, text or pop-up.
What it fixes
The Document Foundation lists 13 security flaws.[1] The Document Foundation doesn’t rate them by severity. They are:
| Flaw | Severity | What The Document Foundation calls it |
|---|---|---|
CVE-2026-63266 | Not rated | Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality |
CVE-2026-63267 | Not rated | LFI and GET SSRF via calcext:data-mappings and csv provider |
CVE-2026-63268 | Not rated | LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href |
CVE-2026-63269 | Not rated | LFI and GET SSRF via GStreamer and HLS playlists |
CVE-2026-63270 | Not rated | Environment/ini-file leaks |
CVE-2026-63277 | Not rated | RCE via calcext:data-mappings, sql provider and jdbc connector |
CVE-2026-63272 | Not rated | Heap buffer overflow in WMF text record import |
CVE-2026-63273 | Not rated | Heap buffer overflow in PDF import encryption handling |
CVE-2026-63274 | Not rated | Heap buffer overflow in PDF import stream handling |
CVE-2026-63275 | Not rated | Stack buffer overflow in CFF font hint handling |
CVE-2026-63276 | Not rated | Stack buffer overflow in CFF to Type 1 font conversion |
CVE-2026-63278 | Not rated | Package URLs can be used to exfiltrate arbitrary INI file values and environment variables |
CVE-2026-63279 | Not rated | Out of bounds read in PICT image import |
How to update, and how long it takes
About five minutes. Close LibreOffice before installing.
- Open LibreOffice and choose Help → Check for Updates…If it offers a new version, download it from libreoffice.org.
- Close LibreOffice and run the download.It installs over the old version; your documents and settings stay.
To check it worked: Help → About LibreOffice (LibreOffice → About LibreOffice on a Mac) shows the version. It should say 26.2.6 or later.
26.2.1 vs 26.2.5
LibreOffice 26.2.1, released 21 Aug 2026, fixed 1 security flaw, one already used in attacks. LibreOffice 26.2.5 fixes 13 security flaws and includes the fixes before it, so going straight to 26.2.5 gets you both.
- Before: LibreOffice 26.2.1, 21 Aug 2026, 1 security flaw
- After: LibreOffice 26.2.6, 5 Nov 2026, 1 security flaw
- LibreOffice updates, every release and the latest version
- Updates, the latest version of everything HARD tracks
References
- ^ The Document Foundation. “LibreOffice Security Advisories”, 21 Sep 2026.