Apache OpenOffice CVE-2026-90626

Exploitation requires a victim to import a crafted (encrypted) PDF file into a vulnerable Apache OpenOffice build (any version through 4.1.16) via the PDF import code path; the malformed PDF triggers an uncontrolled memory access and out-of-bounds write. Limiting factors: there is no network-facing service - the attacker must deliver the file and rely on the user actively opening/importing it (user interaction is mandatory), the target must be running 4.1.16 or earlier, and upgrading to 4.1.17 removes the issue entirely. The advisory confirms only crash/memory corruption; it does not establish reliable code execution.

No CVSS vector, EPSS score, KEV entry, or PoC reference is present in the supplied data, and the vuln.today Decision label is 'awaiting_data' - so quantitative exploitation signals are absent rather than low, and this assessment rests on the vendor advisory text alone. The flaw is a file-parsing memory-corruption bug: it is not a remotely reachable network service but requires a victim to import a crafted encrypted PDF into Apache OpenOffice (through 4.1.16), which bounds real-world risk to social-engineering delivery rather than mass or automated exploitation. The confirmed impact is an out-of-bounds write producing a crash or memory corruption; the advisory does not state that code execution has been achieved, though an attacker-influenced OOB write is the kind of primitive that can sometimes be escalated - this is inferred potential, not a confirmed outcome. Apache rates the issue 'important' and the vendor has shipped a fix. Net: a genuine bug worth patching on a normal cadence, but with no evidence of active exploitation, no public exploit, and a user-interaction requirement, it is not an emergency and should not be treated as a widespread remote-RCE threat on current data. Exploitation status: no public exploit identified at time of analysis.

An attacker crafts a malicious encrypted PDF and delivers it to a victim (for example by email or a download link) who runs a vulnerable Apache OpenOffice build (through 4.1.16). When the victim imports the PDF, the import code performs an out-of-bounds write, crashing the application or corrupting memory, which could potentially be leveraged toward code execution. No public exploit identified at time of analysis.