Apache OpenOffice CVE-2026-90628

Exploitation requires the victim to open a document containing an attacker-crafted CFF font in Apache OpenOffice (version 4.1.16 or earlier) and then invoke the PDF export feature, which is the specific code path containing the uncontrolled memory access. The flaw affects default installations - no special configuration is needed to reach the vulnerable PDF export code - but it is not remotely triggerable against a service: it is limited by the requirement for user interaction (the victim must both open the malicious file and perform the PDF export) and by the absence of any network-exposed attack surface. Versions 4.1.17 and later are not affected.

No CVSS vector, EPSS score, KEV listing, or PoC reference is present in the supplied data, and the vuln.today Decision label is 'awaiting_data' - so several key prioritization signals are explicitly missing rather than confirmed. What is confirmed is a vendor 'important' severity rating and a real memory-safety defect: an uncontrolled memory access in Apache OpenOffice's PDF export code where a crafted CFF font overflows the stack, with vendor-stated outcomes ranging from crash to memory corruption to possible code execution ('or even running other code'). This is a client-side, file-driven vulnerability: it does not expose a network-listening service, and it requires a victim to process a malicious document and invoke PDF export, which materially reduces real-world risk compared with a remote-unauthenticated server bug. There is no public exploit identified at time of analysis and no evidence of active exploitation, so this reads as a genuine but non-emergency patch priority (routine client-side code-execution risk) rather than a high-urgency widely-exploited flaw. Because NVD has assigned no CVSS vector, the authentication and attack-vector characterization here is inferred from the description, not confirmed by an official vector - verify with the vendor advisory if precise scoring is required.

An attacker crafts an office document (or font resource) containing a malicious CFF font and delivers it to a victim, e.g. by email or download. When the victim opens the document in Apache OpenOffice 4.1.16 or earlier and exports it to PDF, the CFF hint-handling code overflows the stack, causing a crash or memory corruption that the vendor states could lead to arbitrary code execution. No public exploit code is identified at time of analysis, and the attack depends on the victim actively performing the PDF export action.