The Apache OpenOffice project closed 13 security vulnerabilities in version 4.1.17, released on October 14. Technical details of the flaws were published on the oss-security list on November 3, and NVD entries were added on November 4. The affected version range is 4.1.16 and earlier. The project recommends that all users upgrade to 4.1.17.
The release is available for download in 41 languages for Windows, macOS, and Linux. It doesn’t add any new features; it only includes security fixes, bug fixes, and updated dictionaries.
The highest-rated flaw is in the Java integration
The most serious issue on the list is CVE-2026-59265. With a CVSS score of 8.8, the flaw is in OpenOffice’s Java integration. When a user opens an untrusted document, attacker-crafted code can be executed; Apache notes that the code may also come from a remote address. Version 4.1.17 fixes this issue. If you can’t update right away, you can go to the OpenOffice section in the Preferences menu, then into Java settings, and disable runtime integration. Apache says this setting stops the attack.
Word, PDF, DXF, and WMF files are also at risk
There are multiple memory errors in the code that handles document formats. In Writer’s Word (WW8) reader, the overflow tracked as CVE-2026-59268 has a score of 7.3; a crafted Word file can crash the program or corrupt memory. On the Draw side, CVE-2026-59267 triggers a heap buffer overflow with a DXF file and carries a score of 7.8.
The PDF side is more crowded. CVE-2026-90624, CVE-2026-90626, and CVE-2026-90634 cause out-of-bounds writes in the import code, and all three are rated 7.3. CVE-2026-90628, which affects CFF font handling during export, causes a heap overflow; Apache writes that this flaw could go as far as “executing other code.” In WMF import, CVE-2026-90629 can also crash the program through invalid memory access.
File reading and spoofed content issues
There are also lower-rated but still annoying flaws. CVE-2026-90627 can read the contents of local files without prompting the user through the flat file database driver. CVE-2026-90632 uses the GStreamer component through audio or video embedded in a document to make a local file get attached to the document. CVE-2026-59263 is based on a crafted document showing different content in different programs; the user may approve data other than what they see on screen. In the low-rated issue tracked as CVE-2026-90631, external links in a document are loaded without prompting, and environment variables may leak.
There is also an issue in the Windows installer package. CVE-2026-59264 is based on uncontrolled search path behavior in the installer files of 4.1.16 and earlier; on a system that has already been compromised, external code can be run with elevated privileges.
What to do
If you’re using OpenOffice 4.1.16 or an older version, move to 4.1.17. The Check for Updates option in the Help menu will do the job; you can also download the installer from openoffice.org. After updating, open the About OpenOffice screen from the Help menu and verify the version number.
If you don’t need Java integration, keep it disabled. Don’t open Word, PDF, DXF, or WMF files from people you don’t know; keep the macro security level set high. None of these flaws are being used in active attacks right now, but when file-handling bugs are left unpatched, they usually start getting exploited within a few months.
Source: Apache OpenOffice security bulletin · NVD
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.