CVE-2026-59264: Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer

Published Nov 3, 2026

Updated

The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache OpenOffice to a version that resolves this vulnerability.
Fixed in 4.1.17

Event History

Nov 4, 2026

CVE Published

via MITRE·11:02 AM

Data Sourced

via MITRE·11:02 AM

DescriptionWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects the Windows installers for Apache OpenOffice 4.1.16 and earlier. Version 4.1.17 is identified as the fixed release.

What does an attacker need to exploit this issue?

The system must already have been manipulated, and a user must interact with the vulnerable installer. The issue can then allow external code to run with elevated access.

What should organizations do?

Upgrade Apache OpenOffice to version 4.1.17. Until upgrading is possible, avoid running the affected Windows installers on systems that may have been manipulated.