Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious .doc with bad WW8 PLCF
-
DeliveryDeliver document to victim via email/web
-
ExploitVictim opens file in OpenOffice
-
ExecutionTrigger heap out-of-bounds write in WW8 reader
-
ImpactCrash or corrupt process memory
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires a user to open an attacker-crafted Microsoft Word document (legacy WW8/.doc format) in Apache OpenOffice version 4.1.16 or earlier; the flaw is in the WW8 PLCF reader code path, so it is reached only through the .doc import filter. Key limiting factors: it is entirely file-/client-side (no network service is exposed), it requires victim user interaction to open the malicious document, and it affects only unpatched installations - version 4.1.17 fixes the issue and upgrading is the vendor's stated remedy. The sources describe the outcome (crash or memory corruption) but do not describe the precise malformed-field trigger mechanism beyond its location in the WW8 PLCF reader. |
| Impact | No CVSS score or vector is provided in any source (NVD, vendor, and third-party all show N/A), and no EPSS score, KEV listing, SSVC decision, or PoC reference is present - the vuln.today decision label is explicitly 'awaiting_data', so quantitative exploitation signals are absent. Risk must therefore be reasoned from the description alone: this is a CWE-787-class heap out-of-bounds write triggered when Apache OpenOffice parses the WW8 (legacy Microsoft Word .doc) PLCF structures in a crafted document. The vendor rates it 'important'. The realistic ceiling is denial of service (the program crashes) with the vendor acknowledging it could 'otherwise corrupt other memory areas'; the sources do NOT claim code execution, so arbitrary-code-execution potential is inferred from the bug class, not confirmed. Because exploitation requires a victim to open a malicious file rather than a remotely reachable service, this is a client-side, user-interaction-dependent issue - lower operational urgency than a network-facing flaw despite the memory-corruption primitive. No exploitation probability data exists to contradict or confirm this, so treat it as a patch-on-normal-cadence desktop risk rather than a confirmed active threat. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted legacy Microsoft Word (.doc) document and lures a victim into opening it in Apache OpenOffice (version ≤ 4.1.16). Parsing the malformed WW8 PLCF structures triggers a heap out-of-bounds write that crashes the application or corrupts adjacent memory. No public exploit or PoC is referenced in the available sources, and code execution is not confirmed by the vendor. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Heap out-of-bounds write in Apache OpenOffice's WW8 (.doc) import filter allows a crafted Microsoft Word document to crash the application or corrupt adjacent heap memory when a victim opens the file in versions through 4.1.16. The flaw sits in the WW8 PLCF reader, so it is reachable only through the legacy Word 97-2003 import path; the assessed vector (AV:L/AC:L/PR:N/UI:R) confirms no authentication is needed but the attacker must entice a user to open the malicious document, and there is no network-facing service component. No EPSS score, KEV listing or public PoC reference is present in the available data (vuln.today decision label 'awaiting_data'), and the vendor's stated remedy is upgrading to Apache OpenOffice 4.1.17, released 2026-10-14.
RemediationAI
Vendor-released patch: Apache OpenOffice 4.1.17, announced 2026-10-14 - upgrading is the fix the vendor explicitly recommends for versions through 4.1.16, and release notes and downloads are linked from https://openoffice.apache.org/ (advisory: https://seclists.org/oss-sec/2026/q4/499). Because the flaw is only reachable when a user opens an attacker-crafted legacy .doc file in the WW8 import filter, an interim compensating control is to avoid opening untrusted or unsolicited Word 97-2003 (.doc) attachments and to convert or re-save such documents in a different format on a trusted machine before review - the trade-off is that this blocks legitimate legacy-document workflows and relies entirely on user behaviour, since the application provides no switch documented in the available sources to disable the WW8 filter. No EPSS, KEV or SSVC signal is present in the supplied data, so remediation should be prioritized from the client-side, user-interaction-required exposure profile rather than from active-exploitation evidence, which is not available.
Affected ProductsAI
Apache OpenOffice versions through 4.1.16 are affected, on the platforms the suite ships for (Windows, Linux and macOS, per the project site); no CPE identifiers were supplied with the advisory. The issue was reported by Yukihiro Nakamura and fixed in Apache OpenOffice 4.1.17, whose release was announced on 2026-10-14 on the project site (https://openoffice.apache.org/); the upstream advisory is the oss-security post at https://seclists.org/oss-sec/2026/q4/499 and the CVE record is at https://www.cve.org/CVERecord?id=CVE-2026-59268. Only the .doc (WW8) import filter path is implicated, so installations that never open legacy Word binary documents are not exposed through that code path.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the filter that parses the Microsoft Word 97-2003 binary format (WW8, the .doc format) inside Apache OpenOffice's Writer import stack. PLCF structures are the plex-based pointer/lookup tables used throughout the WW8 binary format to describe collections of positions and associated data (piece tables, and similar position-indexed structures); the reader must trust the counts and offsets encoded in the file and translate them into in-memory arrays. The reported defect is a heap out-of-bounds write, which means the reader writes past the bounds of a heap allocation while processing a malformed PLCF structure in an attacker-supplied document. The supplied sources assign no CWE identifier and do not describe the precise malformed-field trigger mechanism beyond its location in the WW8 PLCF reader, so the exact malformed field and the arithmetic that produces the out-of-bounds index are not documented in the available evidence. The consequence described by the vendor is a crash or corruption of other memory areas; the assessed impact is integrity and availability only (I:L/A:L) with no confidentiality impact and unchanged scope, reachable at local attack vector with user interaction.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
File-based client-side bug needs the victim to open a crafted document (AV:L, UI:R, PR:N); vendor describes crash plus possible memory corruption, not code execution or data disclosure, so C:N with limited I/A.
Description PRE-NVD
Executive ViewAI
A memory corruption vulnerability in Apache OpenOffice (CVE-2026-59268) enables an attacker to crash the application or corrupt memory when a user opens a malicious Word 97-2003 document, potentially leading to code execution. This affects any employee using OpenOffice through version 4.1.16, putting document-processing workflows at risk. Although no active exploitation has been observed, leadership should prioritize patching to prevent potential data loss or system compromise from socially engineered attacks.
Apply vendor patch. If immediate patching is not possible, block legacy .doc files from external sources at email and web gateways, enforce Mark-of-the-Web on downloaded documents, and consider migrating critical users to alternative office suites until upgrade is complete.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
GitHub PoC
Exploit-DB