Re: CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover

Apache OpenOffice 4.1.16 and earlier has a code execution flaw in its Java integration (CWE-426, untrusted search path). Opening a crafted, untrusted document can cause the application to run arbitrary code, including code loaded from a remote location, with the privileges of the user who opened the file. Anyone still running those versions with Java runtime integration enabled is affected. Apache expects a fix in 4.1.17, which is in release-candidate phase and not yet the general release. No public proof-of-concept is known, the issue is not in CISA KEV, and exploitation in the wild is not known.

Do: Until Apache OpenOffice 4.1.17 is released, disable Java runtime integration in the Preferences dialog, which prevents this attack. Do not open untrusted documents. Upgrade to 4.1.17 as soon as it is generally available.