CVE-2026-59265

Published: Ott 02, 2026 Last Modified: Ott 02, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user.

This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase.

Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.

426

Untrusted Search Path

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability Access Control
Potential Impacts:
Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Read Files Or Directories
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
https://github.com/apache/openoffice/commit/95923fd437e06ed…
https://github.com/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6…
https://github.com/apache/openoffice/commit/c699bed3f75e79b…
https://github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210e…
https://lists.apache.org/thread.html/svfdc1jtpqlw7mo6lgg9ft…
https://lists.apache.org/thread.html/svfdc1jtpqlw7mo6lgg9fthcmf754pl5