CVE-2026-59263

MediumCVSS 5.5/10Last modified Nov 4, 2026

Description

A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-349

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache OpenOffice	<= 4.1.16

References

https://lists.apache.org/thread.html/drr0ss9wrkq0omlrwjhcm8738pjx3xgdMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/11/03/21Mailing List, Third Party Advisory

Timeline

Published: Nov 4, 2026
Last modified: Nov 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-592647.8The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access CVE-2026-592658.8A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger execu CVE-2026-592677.8A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise CVE-2026-592687.3An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document CVE-2026-592693.8A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only i CVE-2026-592709.1Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its l CVE-2026-592716.5When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. CVE-2026-592726.8Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-midd CVE-2026-592746.5The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zi CVE-2026-592754.9A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss CVE-2026-592765.9Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a const CVE-2026-592775.3Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher t