Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-59265: Apache OpenOffice can be taken over by opening malicious document
CVE-2026-59265 · published 1 month ago
Summary
Opening a specially crafted OpenOffice file could cause the program to run any code the attacker wants, potentially giving them control of the computer. Until the next version is released, turn off Java integration in OpenOffice's preferences or simply avoid opening files from untrusted sources. When version 4.1.17 becomes available, update to it to remove the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apache software foundation | apache openoffice |
<= 4.1.16 < 95923fd437e06edd38a4f0e139a27c755a6f3ba6 |
Original advisory text
Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user.
This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase.
Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.
This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase.
Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.
References
- http://www.openwall.com/lists/oss-security/2026/10/08/7 URL
- http://www.openwall.com/lists/oss-security/2026/10/02/2 URL
- https://lists.apache.org/thread.html/svfdc1jtpqlw7mo6lgg9fthcmf754pl5 Vendor Advisory
- https://github.com/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6f... Patch
- https://github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210ee... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59265... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59265 Vendor Advisory
- https://gitbox.apache.org/repos/asf/openoffice.git Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-426Untrusted Search Path
Timeline
Published2 Oct 2026
Updated4 Nov 2026
First seen2 Oct 2026
Track software like this
Free during beta