Apache OpenOffice CVE-2026-59264

Affects only the Windows installers of Apache OpenOffice 4.1.16 and earlier. The required precondition, stated by the vendor, is an 'already manipulated system' - the attacker must first have the local access needed to place attacker-controlled code (e.g. a malicious DLL/executable) in a location the installer searches. Exploitation is then completed when the vulnerable installer is executed, at which point the planted code runs with the installer's elevated access. Limiting factors: requires prior local compromise/write access (not a default or remote condition), requires the installer to actually be run, is Windows-installer-specific, and is fixed in 4.1.17. The exact search-path location and loading mechanism are not described in the available sources.

No CVSS vector, EPSS score, KEV listing, or verified PoC is provided, and the vuln.today Decision label is 'awaiting_data' - so quantitative exploitation signals are absent and cannot be compared. Qualitatively, this is an uncontrolled search path element (DLL/executable hijacking) in the Windows installer of Apache OpenOffice 4.1.16 and earlier, and the vendor rates it only 'moderate'. The description's phrase 'already manipulated system' is the decisive limiter: exploitation presupposes that an attacker (or prior malware) has already achieved the local foothold needed to place a malicious file in a directory the installer searches, which makes this a privilege-escalation / code-execution amplifier rather than an initial-access or remotely-wormable flaw. There is no evidence of active exploitation and no exploit code is referenced, so despite the potential for elevated code execution this should be treated as a patch-in-normal-cycle item (gated by the 'awaiting_data' decision), not an emergency - prioritize it on Windows endpoints where the 4.1.16-or-earlier installer may still be run.

On a system where an attacker already has low-privileged local access, they drop a malicious DLL into a directory the Apache OpenOffice Windows installer searches (for example the folder containing the downloaded installer). When a user or administrator subsequently runs that installer - typically with elevation - the planted DLL is loaded and its code executes with the installer's elevated privileges. No public exploit was identified at the time of analysis; the exact trigger location on the search path is not described in the available sources.