CVE-2026-90632: Apache OpenOffice: Local file inclusion via GStreamer plugin
Apache OpenOffice documents can include multimedia content (audio, video, etc.)
A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OpenOfficeto a version that resolves this vulnerability.Fixed in 4.1.17
Event History
Frequently Asked Questions
What does an attacker need to do to exploit this issue?
An attacker needs to provide a crafted Apache OpenOffice document containing multimedia content. Exploitation requires a user to open the document and save or export it, such as exporting it to PDF.
Who is affected?
Users of Apache OpenOffice versions through 4.1.16 are affected when processing crafted documents with multimedia content. The issue can expose the contents of local files accessible to the user running OpenOffice.
What is the recommended remediation?
Upgrade Apache OpenOffice to version 4.1.17, which fixes the issue.