AI Weekly Malaysia

The Document Foundation says LibreOffice will not add AI features for the foreseeable future, following its late-August release that it says contains no generative AI features. The nonprofit frames this as a deliberate design position: documents are not uploaded for processing, no part of the software requires a network connection, and users retain control over data. LibreOffice, used by tens of millions of people and organizations, still lets users install extensions that connect to local AI models.

Why: If you handle confidential, legally privileged, or personal documents, LibreOffice’s no-AI and no-network-required stance gives a concrete audit-friendly assurance that data does not leave the machine. But it also means built-in AI help is absent by default, so any AI workflow requires you to add and manage local-model extensions yourself. For builders deciding whether to bundle AI into a product, this is a counterexample to treating AI features as mandatory.

Researchers demonstrated that a crafted Calc spreadsheet can make LibreOffice and Apache OpenOffice execute attacker-controlled Java code the moment the file is opened, with no macro-style trust prompt. The chain abuses intended features: a 'database range' in the sheet auto-refreshes from a remote ODB file named by a URL, which in turn names a JDBC driver whose JAR is downloaded and run inside the application. LibreOffice fixed it as CVE-2026-63277 in the October 5 updates (26.2.5 / 26.8.0); Apache OpenOffice has no fix yet for CVE-2026-59265, with every version up to 4.1.16 affected and 4.1.17 still in testing. The attack requires Java support to be enabled, was shown as a proof of concept on Windows and Linux, and has no reported real-world use.

Why: Your existing defence — 'never enable macros in an untrusted document' — does not stop this, because no macro is involved. If your team or clients run LibreOffice, the decision is a version check: anything below 26.2.5 or 26.8.0 needs the October 5 update. If anyone is still on Apache OpenOffice, there is no patch available for any release up to 4.1.16, so the only options today are turning Java off in settings or refusing to open spreadsheets from outside your organisation — worth knowing before you accept a supplier's .ods or .xlsx file. This is especially relevant where open-source office suites are chosen to avoid Microsoft licensing, since those installs often sit on shared or lightly managed machines.