1.9 Low

CVE-2026-59263 Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.

Description

A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

CVSS 4.0 detail

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/S:P/AU:N/R:A/U:Green

Exploitable with local access to the machine, without an account and if a user takes an action; the impact on data or service is limited.

Attack vector: Local
Attack complexity: Low
Attack requirements: None
Privileges required: None
Interaction: Passive
Confidentiality: Low
Integrity: None
Availability: None
Confidentiality of other systems: Low
Integrity of other systems: Low
Availability of other systems: None

Affected products and versions

Product	Affected versions	Fixed in
Apache OpenOffice 4.1	earliest → 4.1.16	No fix stated

References

lists.apache.org lists.apache.org

Timeline

Published November 4, 2026
Last modified November 4, 2026

The 39 CVEs of Apache OpenOffice →

CVE-2026-59267 Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption 5.8 Medium CVE-2026-90632 Apache OpenOffice: Local file inclusion via GStreamer plugin Not rated CVE-2026-90634 Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files Not rated CVE-2026-90631 Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables Not rated

Track this CVE