CVE-2026-59265highCWE-426

CVE-2026-59265: falha de alta gravidade em Apache OpenOffice

Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover

Publicada em · Atualizada em

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 8.8epss 0.4%
da publicação à arma4 dias
Publicada no NVD2 de out.
1ª PoC+4d
probabilidade de exploração
0.4%top 65% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase. Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache OpenOffice
PoCs públicas encontradas — 1
githubgithub.com/HORKimhab/CVE-2026-59265★ 0
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Apache OpenOffice

No mesmo produto, das mais perigosas para as menos.

CVE-2021-33035—Buffer overflow from a crafted DBF fileEPSS 50.6%CVE-2021-30245—Code execution in Apache OpenOffice via non-http(s) schemes in HyperlinksEPSS 4.9%CVE-2021-40439—Billion LaughsEPSS 3.9%CVE-2017-3157—CVE-2017-3157EPSS 3.1%CVE-2016-6804—CVE-2016-6804EPSS 3.0%CVE-2017-12608—CVE-2017-12608EPSS 2.9%
Referências
https://github.com/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6f3ba6.patchhttps://github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210eed281.patchhttps://lists.apache.org/thread.html/svfdc1jtpqlw7mo6lgg9fthcmf754pl5http://www.openwall.com/lists/oss-security/2026/10/02/2http://www.openwall.com/lists/oss-security/2026/10/08/7