CVE-2026-59263: Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.
A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OpenOfficeto a version that resolves this vulnerability.Fixed in 4.1.17 - Compensating control
Do not open corrupt or manipulated documents that could display substituted or different data.
Event History
Frequently Asked Questions
Which Apache OpenOffice versions are affected?
Apache OpenOffice 4.1.16 and earlier are affected. Version 4.1.17 fixes the issue.
What must an attacker do to exploit this issue?
An attacker must provide a manipulated, corrupt document and have it opened in an affected Apache OpenOffice version. The impact described is substituted content being displayed in a way that can manipulate the user.
Are users exposed through normal document handling?
Exposure occurs when users open manipulated documents in affected versions. The advisory states that corrupt documents should not be opened.
What should be done if upgrading cannot happen immediately?
Do not open corrupt or manipulated documents, particularly when their origin or integrity cannot be trusted. Upgrade to Apache OpenOffice 4.1.17 when possible.