Apache OpenOffice CVE-2026-90627

Exploitation requires a victim to open an attacker-crafted document in Apache OpenOffice 4.1.16 or earlier; the document embeds a flat-file database / SQL-provider reference that causes the flat file database driver to read an arbitrary local file. The key enabling condition is that this read occurs 'without asking the user,' so no consent prompt limits it, and no special non-default configuration is indicated - the driver processes such references as part of normal document handling. The principal limiting factor is the required user interaction (the victim must obtain and open the malicious document); the attacker cannot reach the function over a network service unprompted. The vendor states upgrading to 4.1.17 fixes the issue.

No CVSS vector, EPSS score, or SSVC technical-impact data was supplied (the vuln.today decision label is 'awaiting_data'), so quantitative exploitation signals are absent and cannot be cross-referenced. The CVE is not listed in CISA KEV and no PoC or exploit reference appears in the input, so this is 'no public exploit identified at time of analysis.' Based on the description alone, this is an arbitrary local-file-read (information disclosure) triggered when a victim opens a crafted document - it does not grant code execution, which caps the real-world impact below critical despite the vendor's 'important' rating. The need for user interaction (opening a malicious document) makes this far better suited to targeted social-engineering/phishing than to automated mass exploitation; the notable aggravating factor is that files are read 'without asking the user,' removing a safeguard that would normally gate such access. Net: a credible targeted data-theft risk rather than a wormable emergency, but note that the absence of CVSS/EPSS/KEV data means this assessment rests on the vendor description only and should be revisited if those signals arrive.

An attacker crafts an OpenOffice document that embeds a flat-file database reference pointing at a sensitive local path (for example an SSH private key, browser profile, or configuration file) and delivers it to a victim via email or download. When the victim opens the document in Apache OpenOffice 4.1.16 or earlier, the flat file database driver reads the referenced file silently - without prompting - and its contents become available for display or exfiltration. No public exploit code is identified in the available sources at the time of analysis.