Apache OpenOffice Draw CVE-2026-59267

Exploitation requires a victim to open an attacker-crafted DXF document in Apache OpenOffice Draw (version 4.1.16 or earlier); the flaw is in the DXF LWPOLYLINE import routine. There is no network-reachable service involved - per the CVSS 4.0 vector this is local (AV:L) and requires user interaction (UI:P), so the attacker must deliver the file and rely on the user opening it. The vendor rated attack complexity High (AC:H), indicating additional conditions must be met for the overflow to trigger reliably, though the specific conditions are not described in the available sources. Limiting factors: mandatory user interaction, no remote/unauthenticated network path, high attack complexity, and the fact that only versions up to 4.1.16 are affected (4.1.17 fixes it).

This is a medium-severity, locally-triggered memory-corruption flaw whose real-world risk is meaningfully lower than its CRITICAL-sounding memory-corruption category. The only quantitative signal provided is a CVSS 4.0 base score of 5.8 (medium) with vector AV:L/AC:H/AT:N/PR:N/UI:P, meaning exploitation is NOT over the network - it requires the attacker to get a crafted DXF file onto the victim's machine and have the victim open it in Draw, and the vendor rated attack complexity High (AC:H). The embedded CVSS 4.0 exploit-maturity metric is E:U (exploitation unreported), there is no CISA KEV listing, no EPSS score is supplied, and no PoC or exploit reference appears anywhere in the input, so the signals are internally consistent and all point the same way: no evidence of exploitation. The vuln.today Decision label is 'awaiting_data', i.e. not an act_now/emergency priority. One tension worth flagging: the vendor's 4.0 vector sets the subsequent-system metrics SC/SI/SA to High, which implies impact crossing to another system, yet the description only states 'a crash or otherwise a corruption of memory areas' within the application - so the High vulnerable-system and subsequent-system impacts are not substantiated by the description and should be treated as the vendor's worst-case rating rather than confirmed code execution. Net: a genuine bug worth patching on the normal cycle, but not a widespread or urgently-exploited threat on current data.

An attacker crafts a malicious DXF drawing file and delivers it to a victim (email attachment, download, shared drive); when the victim opens it in Apache OpenOffice Draw, the LWPOLYLINE import path overflows a heap buffer. No public exploit has been identified, and the CVSS AV:L/UI:P/AC:H vector means the attack depends on the user opening the file and on conditions the vendor rated as high-complexity, so the realistic outcome is an application crash, with memory corruption that is not confirmed to yield code execution.