https://seclists.org/oss-sec/2026/q4/31: CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover

Q: What must an attacker do to exploit this issue?

The attacker needs to provide a crafted, untrusted document and persuade a user to open it in Apache OpenOffice. Opening the document can trigger arbitrary code execution, including remote code.

Q: Are installations using the default Java integration exposed?

Yes. The issue is in Apache OpenOffice's Java integration, and disabling Java runtime integration in the Preferences dialog prevents the attack.

Q: What can be done before an update is available?

Disable Java runtime integration in the Preferences dialog. If that cannot be done, avoid opening untrusted files; this is also recommended as an additional precaution.

Q: Which versions need remediation?

Apache OpenOffice 4.1.16 and earlier are affected. The issue is expected to be fixed in version 4.1.17 when it is released; the provided fixed source revisions are 95923fd437e06edd38a4f0e139a27c755a6f3ba6 and 181421139242694b309751fb666406eddc203c50.

Published Oct 2, 2026

Updated

Affected Software

1 affected component

Apache OpenOffice<=4.1.16

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker needs to provide a crafted, untrusted document and persuade a user to open it in Apache OpenOffice. Opening the document can trigger arbitrary code execution, including remote code.

Are installations using the default Java integration exposed?

Yes. The issue is in Apache OpenOffice's Java integration, and disabling Java runtime integration in the Preferences dialog prevents the attack.

What can be done before an update is available?

Disable Java runtime integration in the Preferences dialog. If that cannot be done, avoid opening untrusted files; this is also recommended as an additional precaution.

Which versions need remediation?

Apache OpenOffice 4.1.16 and earlier are affected. The issue is expected to be fixed in version 4.1.17 when it is released; the provided fixed source revisions are 95923fd437e06edd38a4f0e139a27c755a6f3ba6 and 181421139242694b309751fb666406eddc203c50.