Apache OpenOffice 4.1.17 fixes seven flaws through 4.1.16
First merged summary.
Apache OpenOffice 4.1.17 fixes seven vulnerabilities affecting versions through 4.1.16, disclosed on oss-security.
Apache OpenOffice versions through 4.1.16 are affected by seven vulnerabilities disclosed on oss-security, with fixes in 4.1.17. The issues include out-of-bounds writes when importing encrypted PDFs (CVE-2026-90626 and CVE-2026-90634), a stack overflow in CFF hint handling during PDF export (CVE-2026-90628), and invalid memory access during WMF import (CVE-2026-90629). Local file inclusion can occur via SQL provider and flat-file database references (CVE-2026-90627) and via the GStreamer multimedia component (CVE-2026-90632). A missing authorization check can load external links without a prompt and may leak environment variables (CVE-2026-90631). Users are recommended to upgrade to 4.1.17. No exploitation in the wild is described.
- Affected releases are Apache OpenOffice through 4.1.16; fixed in 4.1.17.
- CVE-2026-90626 and CVE-2026-90634 are encrypted-PDF import out-of-bounds writes.
- CVE-2026-90628 is a CFF font stack overflow in PDF export code.
- CVE-2026-90627 and CVE-2026-90632 are local file inclusion issues.
- CVE-2026-90631 can load external links without a prompt.
- Anthropic and Ada Logics are credited on several issues; CVE-2026-90634 credits a ZDI researcher.
Timeline
dated events in the reporting · oldest first- Nov 3, 2026oss-security posts seven Apache OpenOffice advisories fixed in 4.1.17. · oss-security
What each outlet adds
beyond the shared facts- oss-securityLists all seven CVEs, affected versions, fix, and finder credits.
- CVEs
- CVE-2026-90627CVE-2026-90626CVE-2026-90634CVE-2026-90632CVE-2026-90631CVE-2026-90629CVE-2026-90628
- Vendors
- Apache
- Products
- OpenOffice
- Organizations
- TrendAI Zero Day Initiative
Coverage
oldest first · one row per article · UTC- · 7d ago
oss-securityFirst report
Apache OpenOffice vulnerable to out-of-bounds write in PDF import (CVE-2026-90626)
Out-of-bounds write when importing encrypted PDF files in Apache OpenOffice through 4.1.16 allows program crash or memory corruption.
- · 7d ago
Apache OpenOffice vulnerable to local file inclusion (CVE-2026-90627)
Local file inclusion via SQL provider and flat file database references in Apache OpenOffice through 4.1.16.
- · 7d ago
Apache OpenOffice CFF font handling causes stack overflow (CVE-2026-90628)
Apache OpenOffice through 4.1.16 permits crafted CFF fonts to cause stack overflow and program crash.
- · 7d ago
Apache OpenOffice WMF import allows out of bounds memory access (CVE-2026-90629)
Apache OpenOffice through 4.1.16 permits crafted WMF files to cause invalid memory access and program crash.
- · 7d ago
Apache OpenOffice documents load external links without prompt (CVE-2026-90631)
Apache OpenOffice through 4.1.16 allows external links to load without prompt, potentially leaking environment variables.
- · 7d ago
Apache OpenOffice local file inclusion via GStreamer plugin
Apache OpenOffice through 4.1.16 allows crafted documents to load any local file contents through GStreamer multimedia component when saved or exported.
- · 7d ago
Apache OpenOffice out-of-bounds write in PDF import
Apache OpenOffice through 4.1.16 allows out-of-bounds memory write when importing encrypted PDF files, causing crash or memory corruption.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90626 | Out-of-bounds write in Apache OpenOffice PDF import | 7.3 group max | — |