CVE-2026-59265: Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user.
This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase.
Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OpenOfficeto a version that resolves this vulnerability.Fixed in 4.1.17 - Configuration
Disable Java runtime integration in the Preferences dialog.
Apache OpenOffice Java runtime integration = disabled - Compensating control
Avoid opening untrusted files entirely.
Event History
Frequently Asked Questions
What user action is required for exploitation?
The user must open a crafted, untrusted document in Apache OpenOffice. Opening that document can cause arbitrary code, including remote code, to execute.
Which installations are affected?
Apache OpenOffice version 4.1.16 and earlier are affected. The issue is in the product's Java runtime integration.
Can the issue be mitigated before an update is available?
Yes. Disable Java runtime integration through the Preferences dialog; this prevents the attack. If Java integration cannot be disabled, do not open untrusted files.
What version fixes the issue?
Version 4.1.17 is expected to fix the issue, but it is currently in the release candidate phase. Upgrade after that version is released.