CVE-2026-59267: Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption
A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OpenOfficeto a version that resolves this vulnerability.Fixed in 4.1.17
Event History
Frequently Asked Questions
Who is exposed to this issue?
Apache OpenOffice users running version 4.1.16 or earlier are affected when they use Draw to import a crafted DXF document.
What does exploitation require?
An attacker needs to provide a crafted DXF document and have a user import it in Draw. The published vector indicates local attack conditions and user interaction are required.
What should be done to remediate the issue?
Upgrade Apache OpenOffice to version 4.1.17, which fixes the heap buffer overflow.
What is the impact if exploitation succeeds?
The crafted import can trigger a crash or corrupt memory areas. The vulnerability metrics indicate potential high impact to confidentiality, integrity, and availability.