Vulnerability in Apache Software Foundation Apache OpenOffice

[ Description ]Official description

A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase. Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.

[ Fixes ]Fixes and patches

• Security bulletin: OpenOffice CVE-2026-59265Vendor patch or bulletin · CERT-FR · openoffice.org/security/cves/CVE-2026-59265.html, cited by CERT-FR CERTFR-2026-AVI-1260

[ Advisories ]Government CERT advisories

• CERT-FR5 Oct 2026CERTFR-2026-AVI-1260

  Multiple vulnerabilities in OpenOffice Translated from French

  Multiple vulnerabilities have been discovered in OpenOffice. They allow an attacker to cause remote arbitrary code execution.

  CVE-2026-63277CVE-2026-59265
• BSI CERT-Bund4 Oct 2026WID-SEC-2026-3725

  Apache OpenOffice: Vulnerability allows code execution Translated from German

  CVE-2026-59265

[ References ]References

• github.com/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6f3ba6.patch
• github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210eed281.patch
• lists.apache.org/thread.html/svfdc1jtpqlw7mo6lgg9fthcmf754pl5
• www.openwall.com/lists/oss-security/2026/10/02/2
• www.openwall.com/lists/oss-security/2026/10/08/7