What’s Vulnerable › Vulnerabilities

CVE-2026-59265: Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-02 · updated 2026-10-08
• Weakness: CWE-426

Description

A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase. Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.

Affected products

• Apache Software Foundation Apache OpenOffice: through 4.1.16

References

• https://github.com/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6f3ba6.patch
• https://github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210eed281.patch
• https://lists.apache.org/thread.html/svfdc1jtpqlw7mo6lgg9fthcmf754pl5
• http://www.openwall.com/lists/oss-security/2026/10/02/2
• http://www.openwall.com/lists/oss-security/2026/10/08/7

Get alerted when CVE-2026-59265 or the next vulnerability affects your stack