A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process.
This issue affects Apache OpenOffice: through 4.1.16.
Users are recommended to upgrade to version 4.1.17, which fixes the issue.
Apache OpenOffice documents can include multimedia content (audio, video, etc.)
A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Severity: important
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Credit:
Anonymous working with TrendAI Zero Day Initiative (finder)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-90634
Severity: important
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
Apache OpenOffice documents can include multimedia content (audio, video, etc.)
A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Credit:
Edoardo Geraci and Thomas Rinsma of Codean Labs (finder)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-90632
Severity: important
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process.
This issue affects Apache OpenOffice: through 4.1.16.
Users are recommended to upgrade to version 4.1.17, which fixes the issue.
Credit:
Edoardo Geraci and Thomas Rinsma of Codean Labs (finder)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-90631
Severity: important
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Credit:
Anthropic and Ada Logics (finder)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-90629
Severity: important
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Credit:
Anthropic and Ada Logics (finder)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-90628
Severity: important
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Credit:
Edoardo Geraci and Thomas Rinsma of Codean Labs (finder)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-90627
Severity: important
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Credit:
Anthropic and Ada Logics (finder)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-90626
Severity: important
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Credit:
Anonymous working with TrendAI Zero Day Initiative (finder) Anthropic and Ada Logics (finder)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-90624
Severity: important
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Credit:
Yukihiro Nakamura (reporter)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-59268
Severity: CVSS 4.0: 5.8 (medium) CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/S:P
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Credit:
Trail of Bits, in collaboration with Anthropic (reporter)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-59267
Severity: moderate
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Credit:
Kazuma Matsumoto, from GMO Cybersecurity by IERAE, Inc. (reporter)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-59264
Severity: CVSS 4.0: 1.9 (low) CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/S:P/AU:N/R:A/U:Green
Affected versions:
- Apache OpenOffice through 4.1.16
Description:
A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Credit:
Yufan You from Tsinghua University (finder)
References:
https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-59263
Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user.
This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase.
Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.
On 10/2/26 13:30, Dave Fisher wrote: Severity: critical
Affected versions:
- Apache OpenOffice through 4.1.16 - Apache OpenOffice before 95923fd437e06edd38a4f0e139a27c755a6f3ba6 - Apache OpenOffice before 181421139242694b309751fb666406eddc203c50
Description:
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user.
This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase.
Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.
Credit:
Thomas Rinsma and Edoardo Geraci from Codean Labs (finder) Rick de Jager (finder)
References:
https://github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210eed281.patch https://github.com/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6f3ba6.patch https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-59265 Does this apply to LibreOffice? -- Sincerely, Demi Marie Obenour (she/her/hers)
Severity: critical
Affected versions:
- Apache OpenOffice through 4.1.16 - Apache OpenOffice before 95923fd437e06edd38a4f0e139a27c755a6f3ba6 - Apache OpenOffice before 181421139242694b309751fb666406eddc203c50
Description:
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user.
This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase.
Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.
Credit:
Thomas Rinsma and Edoardo Geraci from Codean Labs (finder) Rick de Jager (finder)
References:
https://github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210eed281.patch https://github.com/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6f3ba6.patch https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-59265
It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25633 for the LibreOffice advisory.
It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25635 for the LibreOffice advisory.