CERT-FR: multiple vulnerabilities in Apache OpenOffice before 4.1.17 allow remote code execution
CERT-FR bulletin CERTFR-2026-AVI-1463 (5 November 2026) covers multiple vulnerabilities in Apache OpenOffice versions before 4.1.17. CERT-FR says some of them allow arbitrary remote code execution, loss of data confidentiality and integrity, and security policy bypass. The bulletin lists 12 CVEs, each with an OpenOffice advisory dated 5 November 2026. It does not mention exploitation in the wild. The OpenOffice advisory for CVE-2026-59263 says no exploits are known (openoffice.org). Most of the flaws need a user to open a malicious document, which limits the immediate urgency.
Entenda a falha
A vulnerabilidade
Apache OpenOffice before 4.1.17 has 12 CVEs, announced on 5 November 2026. CERT-FR says some allow remote code execution, loss of confidentiality and integrity, and security policy bypass. The most serious is CVE-2026-90624, a heap buffer overflow in PDF parsing described as allowing remote code execution. Other memory-corruption bugs: CVE-2026-59267 (DXF LWPOLYLINE import), CVE-2026-59268 (WW8 PLCF reader), CVE-2026-90626 and CVE-2026-90634 (encrypted PDF import), CVE-2026-90628 (stack overflow in CFF hint handling) and CVE-2026-90629 (WMF import). There are also CVE-2026-90627 and CVE-2026-90632 (local file inclusion via the SQL provider and GStreamer plugin), CVE-2026-90631 (remote document loaded without a prompt, possibly leaking environment variables), CVE-2026-59264 (uncontrolled search path in the Windows installer) and CVE-2026-59263 (low severity, content differs by program). Most need the user to open a malicious document. All are fixed in 4.1.17.
Como funciona
In the memory-corruption cases, the user opens a crafted file, such as a PDF, DXF, WMF or Word-format document. OpenOffice hands it to the matching import code, which reads the file's structures and copies data into memory. With a malformed file, that code writes or reads outside the buffer it allocated, on the heap or the stack. That corrupts memory and can lead to code execution. In the file-inclusion and remote-loading cases, the document makes OpenOffice reach local files or fetch a remote document without asking the user. The articles give no finer step-by-step detail for each CVE.
Por que é vulnerável
The articles do not explain root causes in depth. The vulnerability classes point to file parsers that do not properly validate sizes and bounds (heap and stack overflows, out-of-bounds reads and writes), to features that follow file or remote references without a prompt or restriction, and to an installer that searches for components in an uncontrolled path. The fix is shipped in Apache OpenOffice 4.1.17, but the articles do not describe what changed in the code.
Onde está
The story names the affected components (PDF parsing, DXF LWPOLYLINE import, WW8 PLCF reader, CFF hint handling, WMF import, SQL provider, GStreamer plugin, Windows installer), but no article names files, functions or fixing commits; details are in the per-CVE OpenOffice advisories.
Como foi descoberta
Only one origin is stated: CVE-2026-59263 was reported by an anonymous researcher working with TrendAI Zero Day Initiative. The articles do not say how the other flaws were found. They became public through the OpenOffice advisories dated 5 November 2026 and the CERT-FR bulletin CERTFR-2026-AVI-1463 of the same day. The story says exploitation in the wild is not mentioned, and the advisory for CVE-2026-59263 says no exploits are known.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:29.
Detalhes técnicos
The OpenOffice bulletin page describes the CVEs as follows (openoffice.org):
- CVE-2026-59263: a crafted document can show different content depending on the program that opens it. The project rates it low, and an anonymous researcher working with TrendAI Zero Day Initiative reported it.
- CVE-2026-59264: uncontrolled search path element in the Windows installer.
- CVE-2026-59267: heap buffer overflow in DXF LWPOLYLINE import.
- CVE-2026-59268: heap out-of-bounds write in the WW8 PLCF reader.
- CVE-2026-90624: heap buffer overflow when parsing PDF files, described as allowing remote code execution.
- CVE-2026-90626 and CVE-2026-90634: out-of-bounds write when importing encrypted PDF files.
- CVE-2026-90627: local file inclusion via the SQL provider and flat file database references.
- CVE-2026-90628: stack overflow in CFF hint handling.
- CVE-2026-90629: out-of-bounds memory access during WMF import.
- CVE-2026-90631: a remote document is loaded without a prompt, possibly leaking environment variables.
- CVE-2026-90632: local file inclusion via the GStreamer plugin.
Most of these flaws need a user to open a malicious document. CVSS scores were not retrieved. The bulletin index also lists CVE-2026-59265 (opening a malicious document can lead to system takeover). The CERT-FR bulletin does not list it.
Remediação
Upgrade to Apache OpenOffice 4.1.17. Do not open documents from untrusted sources until the update is applied.
Linha do tempo
-
CERT-FR: multiple vulnerabilities in Apache OpenOffice before 4.1.17 allow remote code execution
ler a análise desta fonte ocultar
CERT-FR bulletin CERTFR-2026-AVI-1463 (5 November 2026) covers multiple vulnerabilities in Apache OpenOffice versions before 4.1.17. CERT-FR says some of them allow arbitrary remote code execution, loss of data confidentiality and integrity, and security policy bypass. The bulletin lists 12 CVEs, each with an OpenOffice advisory dated 5 November 2026. It does not mention exploitation in the wild. The OpenOffice advisory for CVE-2026-59263 says no exploits are known (openoffice.org). Most of the flaws need a user to open a malicious document, which limits the immediate urgency.
Technical Details
The OpenOffice bulletin page describes the CVEs as follows (openoffice.org):
- CVE-2026-59263: a crafted document can show different content depending on the program that opens it. The project rates it low, and an anonymous researcher working with TrendAI Zero Day Initiative reported it.
- CVE-2026-59264: uncontrolled search path element in the Windows installer.
- CVE-2026-59267: heap buffer overflow in DXF LWPOLYLINE import.
- CVE-2026-59268: heap out-of-bounds write in the WW8 PLCF reader.
- CVE-2026-90624: heap buffer overflow when parsing PDF files, described as allowing remote code execution.
- CVE-2026-90626 and CVE-2026-90634: out-of-bounds write when importing encrypted PDF files.
- CVE-2026-90627: local file inclusion via the SQL provider and flat file database references.
- CVE-2026-90628: stack overflow in CFF hint handling.
- CVE-2026-90629: out-of-bounds memory access during WMF import.
- CVE-2026-90631: a remote document is loaded without a prompt, possibly leaking environment variables.
- CVE-2026-90632: local file inclusion via the GStreamer plugin.
Most of these flaws need a user to open a malicious document. CVSS scores were not retrieved. The bulletin index also lists CVE-2026-59265 (opening a malicious document can lead to system takeover). The CERT-FR bulletin does not list it.
Remediation
Upgrade to Apache OpenOffice 4.1.17. Do not open documents from untrusted sources until the update is applied.