Apache OpenOffice CVE-2026-59263

Exploitation requires an attacker to author a specially manipulated document that Apache OpenOffice 4.1.16 or earlier will render with substituted/hidden content instead of reporting the file as corrupt, and then get a victim to open that file in a vulnerable OpenOffice version. Per the vendor CVSS 4.0 vector the vector is local (AV:L) with passive user interaction (UI:P) and no privileges (PR:N), so the limiting factors are: the victim must actually open the attacker-supplied document, the impact is confined to deceiving the human via displayed content (low integrity/confidentiality, no code execution or availability loss), and only Apache OpenOffice builds at or below 4.1.16 are affected - 4.1.17 fixes it. The exact file-format feature abused to cause the substitution is not described in the available sources.

This is a low-severity document-spoofing/content-substitution issue, not a code-execution or memory-safety flaw. The only severity signal provided is the vendor's CVSS 4.0 base score of 1.9 (low) with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N - local attack vector, passive user interaction required, and only low confidentiality/integrity impact arising from a user being shown substituted content. The vuln.today decision label is 'awaiting_data', meaning no prioritization verdict has been reached. There is no CISA KEV listing, no EPSS probability, and no NVD CVSS in the input, so widespread or targeted exploitation cannot be asserted. One nuance worth verifying: the vendor CVSS 4.0 string carries threat metrics E:P (Proof-of-Concept exploit maturity) and S:P/U:Green, yet no PoC or exploit reference accompanies the advisory - the E:P flag is a CVSS annotation, not an independently published exploit, so it should not be read as a working public exploit. Overall this is a genuine integrity/trust concern (a document can be made to look different in OpenOffice than its true bytes, enabling deception) but the real-world risk is low: no automated or remote mass exploitation path, and impact is limited to misleading a human who opens a hand-crafted file.

An attacker crafts a document that Apache OpenOffice 4.1.16 or earlier renders with substituted/hidden content rather than flagging it as corrupt, then delivers it to a victim (e.g., a contract, invoice, or report) so the victim makes a decision based on content that differs from what the file actually contains or from what another program would show. Because the attack vector is local with passive user interaction, the victim must open the file in a vulnerable OpenOffice version. No public exploit is identified; the vendor's CVSS threat metric indicates proof-of-concept maturity, but no PoC exploit reference is provided in the available sources.