https://seclists.org/oss-sec/2026/q4/99: CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover

Q: What interaction is required for exploitation?

An attacker must persuade a user to open a crafted, untrusted document in Apache OpenOffice. Opening the document can trigger arbitrary code execution, including remote code.

Q: Which installations are affected?

Apache OpenOffice 4.1.16 and earlier are affected. Builds lacking either of the referenced fixes, 95923fd437e06edd38a4f0e139a27c755a6f3ba6 or 181421139242694b309751fb666406eddc203c50, are also affected.

Q: What can be done before an updated release is available?

Disable Java runtime integration in the Preferences dialog; this prevents the attack. If Java integration cannot be disabled, avoid opening untrusted files.

Q: What is the planned permanent remediation?

The issue is expected to be fixed in Apache OpenOffice 4.1.17, which is in the release candidate phase. Upgrade to 4.1.17 once it is released.

Published Oct 4, 2026

Updated

Affected Software

1 affected component

Apache OpenOffice<=4.1.16

Frequently Asked Questions

What interaction is required for exploitation?

An attacker must persuade a user to open a crafted, untrusted document in Apache OpenOffice. Opening the document can trigger arbitrary code execution, including remote code.

Which installations are affected?

Apache OpenOffice 4.1.16 and earlier are affected. Builds lacking either of the referenced fixes, 95923fd437e06edd38a4f0e139a27c755a6f3ba6 or 181421139242694b309751fb666406eddc203c50, are also affected.

What can be done before an updated release is available?

Disable Java runtime integration in the Preferences dialog; this prevents the attack. If Java integration cannot be disabled, avoid opening untrusted files.

What is the planned permanent remediation?

The issue is expected to be fixed in Apache OpenOffice 4.1.17, which is in the release candidate phase. Upgrade to 4.1.17 once it is released.