CVE-2026-90624: Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability
Published Nov 3, 2026
·Updated
An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OpenOfficeto a version that resolves this vulnerability.Fixed in 4.1.17
Event History
Nov 4, 2026
CVE Published
via MITRE·11:03 AM
Data Sourced
via MITRE·11:03 AM
DescriptionWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations require remediation?
Apache OpenOffice versions through 4.1.16 are affected. Upgrade to version 4.1.17, which fixes the issue.
2
What must occur for exploitation to be attempted?
An attacker would need to provide a crafted PDF that is processed by the PDF import code. The vulnerability requires user interaction according to the supplied vector.