2 mentions in 7 days · 3 in 30 days · 3 total · first seen · last
A mailing-list reply asks if OpenOffice takeover bug CVE-2026-59265 also affects LibreOffice.
On the oss-security list, Demi Marie Obenour asked whether CVE-2026-59265, described as system takeover by opening a malicious Apache OpenOffice document, also applies to LibreOffice. The message adds no technical details, affected versions, patch status, or evidence of exploitation.
LibreOffice patched spreadsheet code execution; matching OpenOffice flaw CVE-2026-59265 remains unfixed.
Researchers showed that opening a Calc spreadsheet can refresh a database range, download an ODB file, and load an attacker-controlled JDBC driver, running Java code without a macro warning when Java support is enabled. LibreOffice fixed CVE-2026-63277 in versions 26.2.5 and 26.8.0 on October 5. Apache OpenOffice CVE-2026-59265 is unpatched through 4.1.16, with a fix expected in 4.1.17. V12 published proof-of-concept files, and there are no reports of in-the-wild use.
Opening a crafted document in Apache OpenOffice 4.1.16 and earlier can execute arbitrary code and take over the system.
Dave Fisher disclosed CVE-2026-59265, a critical code-execution flaw in Apache OpenOffice through version 4.1.16. A bug in the Java integration lets a crafted untrusted document execute arbitrary code, including remote code, when a user opens it, which can lead to system takeover. Affected builds also include those before commits 95923fd437e06edd38a4f0e139a27c755a6f3ba6 and 181421139242694b309751fb666406eddc203c50. The notice does not report exploitation in the wild.