https://seclists.org/oss-sec/2026/q4/499: CVE-2026-59268: Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader
Published Nov 3, 2026
·Updated
Affected Software
1 affected component
Apache OpenOffice<=4.1.16
Users of Apache OpenOffice versions through 4.1.16 are affected when they open a maliciously crafted Microsoft Word document.
An attacker needs to craft a Microsoft Word document that triggers the out-of-bounds write when processed by the affected WW8 PLCF reader. The advisory does not describe any additional authentication or local-access requirement.
A malicious document can crash Apache OpenOffice or corrupt other memory areas. The provided advisory does not state whether code execution is possible.
Upgrade Apache OpenOffice to version 4.1.17, which fixes the vulnerability.