CVE-2026-59265 json
Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover
published 2026-10-02 37 d ago modified 2026-10-08 32 d ago also EUVD-2026-91764
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user.
This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase.
Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 37 d ago
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
- Apache Software Foundation Apache OpenOffice
Classification
- Weakness
-
- CWE-426 Untrusted Search Path
References
-
github.com
/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210eed281.patch
patch
-
github.com
/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6f3ba6.patch
patch
-
lists.apache.org
/thread.html/svfdc1jtpqlw7mo6lgg9fthcmf754pl5
vendor-advisory
- openwall.com /lists/oss-security/2026/10/02/2
- openwall.com /lists/oss-security/2026/10/08/7
Sources
- CVE List CVE-2026-59265
- NVD CVE-2026-59265
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.