CVE-2026-59265highCWE-426

CVE-2026-59265: fallo de gravedad alta en Apache OpenOffice

Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover

Publicada el · Actualizada el

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 8.8epss 0.4%
de la publicación al arma4 días
Publicada en NVD2 oct
1ª PoC+4d
probabilidad de explotación
0.4%top 65% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase. Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Apache Software Foundation · Apache OpenOffice
PoCs públicas encontradas — 1
githubgithub.com/HORKimhab/CVE-2026-59265★ 0
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Apache OpenOffice

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-33035—Buffer overflow from a crafted DBF fileEPSS 50.6%CVE-2021-30245—Code execution in Apache OpenOffice via non-http(s) schemes in HyperlinksEPSS 4.9%CVE-2021-40439—Billion LaughsEPSS 3.9%CVE-2017-3157—CVE-2017-3157EPSS 3.1%CVE-2016-6804—CVE-2016-6804EPSS 3.0%CVE-2017-12608—CVE-2017-12608EPSS 2.9%
Referencias
https://github.com/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6f3ba6.patchhttps://github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210eed281.patchhttps://lists.apache.org/thread.html/svfdc1jtpqlw7mo6lgg9fthcmf754pl5http://www.openwall.com/lists/oss-security/2026/10/02/2http://www.openwall.com/lists/oss-security/2026/10/08/7