CVE-2026-59268: Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader

Published Nov 3, 2026

Updated

An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas.

Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache OpenOffice to a version that resolves this vulnerability.
Fixed in 4.1.17

Event History

Nov 4, 2026

CVE Published

via MITRE·11:02 AM

Data Sourced

via MITRE·11:02 AM

DescriptionWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of Apache OpenOffice versions through 4.1.16 are affected when they open a crafted Microsoft Word document. Exploitation requires local access to the application and user interaction, as reflected by the AV:L and UI:R vector components.

What should teams do to remediate it?

Upgrade Apache OpenOffice to version 4.1.17, which fixes the issue.

What is the impact if exploitation succeeds?

A crafted document can crash Apache OpenOffice or corrupt other memory areas. The assigned vector indicates high confidentiality and integrity impact, with low availability impact.