Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted PDF to victim
-
ExploitVictim opens/imports PDF in OpenOffice
-
ExecutionTrigger out-of-bounds write in PDF import parser
-
ImpactCorrupt memory or execute code as the user
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the victim to open or import an attacker-crafted PDF through the PDF import code path of Apache OpenOffice versions through 4.1.16; the flaw is in that specific parser, so a benign document flow is not affected. The decisive limiting factor is required user interaction - the attacker cannot trigger it without the user opening the malicious file - which makes it unsuitable for unattended remote compromise. No authentication is involved, and there is no indication a non-default configuration is needed: the PDF import capability is a standard feature of the suite. Upgrading to 4.1.17 is the fix stated by the vendor. |
| Impact | No vendor or NVD CVSS vector, EPSS score, or KEV entry is present in the input, and the vuln.today decision label is 'awaiting_data', so quantitative exploitation signals are absent and cannot be compared - any severity here is my own inference, not a confirmed authority rating. On the mechanism, this is an unchecked memory access (out-of-bounds write) in the PDF import code reachable by opening a crafted PDF, which inherently requires user interaction to trigger, so it is not a remotely-wormable service flaw and real-world risk is gated by whether a victim opens an attacker-supplied document. My independent assessment is CVSS 3.1 7.8 (High) driven by local file-open delivery with full impact if code execution is achieved. There is a notable conflict in the evidence itself: the ZDI/advisory title claims 'Remote Code Execution', but the technical description only states the OOB write 'could crash the program or cause memory corruption' and does not confirm achieved code execution - so RCE should be treated as the worst-case potential, not a verified outcome. No public exploit is referenced, exploitation status is unknown, and a complete fix exists (4.1.17), so this is a patch-promptly item rather than a confirmed active-exploitation emergency. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted PDF and convinces a victim to open or import it in Apache OpenOffice 4.1.16 or earlier. The malformed PDF triggers an out-of-bounds write in the PDF import parser, corrupting memory to crash the application or potentially execute attacker code in the context of the user. No public exploit code is referenced in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
A heap-based out-of-bounds memory write in the PDF import code of Apache OpenOffice through 4.1.16 lets a crafted PDF file corrupt memory and potentially achieve code execution in the context of the user who opens it. Exploitation requires the victim to open or import a malicious PDF through the suite's standard PDF import path, so the attacker cannot trigger it without that user interaction; no authentication is involved and no non-default configuration is needed. No public exploit code, EPSS score, or KEV entry is present in the available data, and the vuln.today decision label is 'awaiting_data', so quantitative exploitation signals are absent; the vendor rates the issue important and has released 4.1.17 as the fix.
RemediationAI
Upgrade to Apache OpenOffice 4.1.17, the version the vendor states fixes this issue; release notes, source and binaries are linked from https://openoffice.apache.org/ (4.1.17 announced 2026-10-14), and the advisory is at https://seclists.org/oss-sec/2026/q4/500. Because exploitation depends on a user opening or importing a crafted PDF through the PDF import code path, organizations that cannot immediately deploy 4.1.17 can reduce exposure by ensuring untrusted PDF attachments are not opened in OpenOffice (for example, opening PDFs only in a separate, sandboxed viewer, or blocking PDF attachments at the mail gateway) and by running OpenOffice with reduced privileges; the trade-off is that such controls depend on user behavior and do not remove the vulnerable parser from the install base, and the vendor's stated complete fix is the 4.1.17 update. No workaround specific to the PDF import code was published in the available data.
Affected ProductsAI
Apache OpenOffice versions through 4.1.16 are affected, across the Windows, Linux and macOS builds the project distributes. The vendor statement covers all releases up to and including 4.1.16, the most recent prior release (published 2025-11-10 per the project site), with no narrower version floor given; the exposure applies to the bundled PDF import functionality in these default installations. The fixed release is Apache OpenOffice 4.1.17, announced 2026-10-14. Vendor information is at https://openoffice.apache.org/ and the advisory thread at https://seclists.org/oss-sec/2026/q4/500, with the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-90624. No CPE strings were provided in the available data to further constrain the affected configurations.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an unchecked memory access in Apache OpenOffice's PDF import/parsing component, where a crafted PDF causes an out-of-bounds memory write (memory corruption) of the heap-based buffer overflow class; the vendor advisory does not state the specific PDF structure, object type, or code path that triggers the write, so the exact trigger is not described in the available sources. The parser is reached whenever a user opens or imports a PDF in OpenOffice, which is a standard feature rather than an optional add-on, meaning default installations through 4.1.16 on Windows, Linux and macOS are exposed. The independent assessment scores the issue CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting local attack vector plus required user interaction, with high confidentiality, integrity and availability impact and no privileges required; the practical consequence of successful corruption is code execution under the user's account or a crash. No CWE assignment or CVSS vector was supplied by NVD-style sources in the input, so the root-cause classification rests on the vendor's description of an out-of-bounds write during PDF parsing.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
File-parsing flaw needing the victim to open a crafted PDF, so AV:L and UI:R with no auth (PR:N); OOB write gives worst-case full C/I/A in the user's context.
Description PRE-NVD
Executive ViewAI
Apache OpenOffice versions through 4.1.16 contain a critical memory corruption vulnerability that can be triggered when a user opens a malicious PDF, potentially allowing an attacker to execute code with the user's privileges. This puts any employee who uses OpenOffice for PDF handling at risk, and a successful exploit could lead to unauthorized access, data loss, or system compromise, undermining trust in document workflows. Leadership should prioritize remediation because exploitation requires no authentication and the attack vector is a common business file format.
Vendor-released patch: 4.1.17
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB