https://seclists.org/oss-sec/2026/q4/506: CVE-2026-90632: Apache OpenOffice: Local file inclusion via GStreamer plugin
Published Nov 3, 2026
·Updated
Affected Software
1 affected component
Apache OpenOffice<=4.1.16
The attacker needs to provide a crafted Apache OpenOffice document containing multimedia content. Exploitation occurs when the GStreamer multimedia component processes that document.
The crafted document can cause contents of arbitrary local files to be loaded and then included when the document is saved or exported, such as to PDF.
The issue affects Apache OpenOffice through version 4.1.16 where the GStreamer multimedia component is used to process crafted document multimedia content. The advisory does not state any additional configuration prerequisite.
Do not open or process untrusted OpenOffice documents that include multimedia content, and avoid saving or exporting such documents. Upgrade to Apache OpenOffice 4.1.17 when possible.