Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Apache OpenOffice 4.1.17 Fixes Four Vulnerabilities

1 source · 4 articlesFirst reported Updated ()
What's new

November 3: Reports detail four CVEs including document substitution and GStreamer inclusion; upgrade to 4.1.17 confirmed.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Four issues in Apache OpenOffice 4.1.16 allow document substitution, remote loading without prompt, Windows installer path issues, and local file inclusion via GStreamer; all fixed in 4.1.17.

Multiple vulnerabilities affect Apache OpenOffice through version 4.1.16. CVE-2026-59263 enables crafted documents to display substituted content instead of corruption. CVE-2026-59264 involves an uncontrolled search path in the Windows installer. CVE-2026-90631 allows remote documents to load without prompting, potentially leaking environment variables. CVE-2026-90632 permits the GStreamer component to load any local file contents when documents are saved or exported. Users are urged to upgrade to 4.1.17.

Key facts
  • CVE-2026-59263: document substitution in 4.1.16
  • CVE-2026-59264: uncontrolled search path in Windows installer
  • CVE-2026-90631: remote links load without prompt, leak env vars
  • CVE-2026-90632: GStreamer loads any local file in saved/exported docs
  • Fixed in Apache OpenOffice 4.1.17
  • Affects through 4.1.16
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 3, 2026CVE-2026-59263 disclosed · oss-security
  2. Nov 3, 2026CVE-2026-59264 disclosed · oss-security
  3. Nov 3, 2026CVE-2026-90631 disclosed · oss-security
  4. Nov 3, 2026CVE-2026-90632 disclosed · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityDetails four CVEs and upgrade to 4.1.17 for all issues.
CVEs
CVE-2026-90632CVE-2026-90631CVE-2026-59264CVE-2026-59263
Vendors
Apache
Products
OpenOffice
Organizations
TrendAI Zero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · 8h ago oss-securityFirst report

    Apache OpenOffice documents could display different data when opened with different programs (CVE-2026-59263)

    Manipulated documents in Apache OpenOffice 4.1.16 and earlier may display substituted content instead of being reported as corrupt.

  2. · 8h ago oss-security

    Apache OpenOffice has uncontrolled search path element vulnerability in Windows installer (CVE-2026-59264)

    Uncontrolled search path vulnerability in Windows installer of Apache OpenOffice up to 4.1.16.

  3. · 8h ago oss-security

    Apache OpenOffice documents load external links without prompt (CVE-2026-90631)

    Apache OpenOffice through 4.1.16 allows external links to load without prompt, potentially leaking environment variables.

  4. · 8h ago oss-security

    Apache OpenOffice local file inclusion via GStreamer plugin

    Apache OpenOffice through 4.1.16 allows crafted documents to load any local file contents through GStreamer multimedia component when saved or exported.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-59263
———
CVE-2026-59264
———
CVE-2026-90631
———
CVE-2026-90632
———