Apache OpenOffice CFF font handling causes stack overflow (CVE-2026-90628)
Original title: CVE-2026-90628: Apache OpenOffice: Stack overflow in CFF hint handling
Apache OpenOffice through 4.1.16 permits crafted CFF fonts to cause stack overflow and program crash.
An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code. Users are recommended to upgrade to version 4.1.17.
- Issue discovered by Anthropic and Ada Logics
- Credit: Anthropic and Ada Logics (finder)
Impact: Program crash or memory corruption
| Product | Affected | Fixed in |
|---|---|---|
| Apache OpenOffice | through 4.1.16 | 4.1.17 |
- 1.Upgrade to version 4.1.17
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90628 | — | — | — |
From the original article
Posted by Arrigo Marchiori on Nov 03 Severity: important Affected versions: - Apache OpenOffice through 4. 1. 16 Description: An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.