CVE-2026-90631: Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables
Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process.
This issue affects Apache OpenOffice: through 4.1.16.
Users are recommended to upgrade to version 4.1.17, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OpenOfficeto a version that resolves this vulnerability.Fixed in 4.1.17
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to craft a document containing external links and persuade a user to open or interact with that document. The vulnerable application may then load those links without prompting the user.
What information could be exposed?
External-link loading may transfer the contents of environment variables. The provided information does not indicate exposure of file contents, credentials, or data beyond environment variables.
Which installations are affected and what is the remediation?
Apache OpenOffice versions through 4.1.16 are affected. Upgrade to Apache OpenOffice 4.1.17, which fixes the issue.