CVE-2025-64406: Apache OpenOffice: Possible memory corruption during CSV import

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-12 · updated 2026-10-18
Weakness: CWE-787

Description

An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other memory areas. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue.

Affected products

Apache Software Foundation Apache OpenOffice: before 4.1.16 — fixed in 4.1.16

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache OpenOffice 4.1.16. Check the vendor advisory for mitigations.

References

https://lists.apache.org/thread/py89gpogxfb2yo9c5vwv2h9x3m85pfmm
https://www.openoffice.org/security/cves/CVE-2025-64406.html
http://www.openwall.com/lists/oss-security/2025/11/11/9

Get alerted when CVE-2025-64406 or the next vulnerability affects your stack