Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted WMF file to victim
-
DeliveryUser opens file in OpenOffice
-
ExploitWMF import parses malformed data
-
ExecutionOut-of-bounds memory access triggered
-
ImpactCrash or memory corruption
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the victim to open or process an attacker-supplied crafted WMF (Windows Metafile) image - either a standalone WMF or one embedded in a document - in Apache OpenOffice version 4.1.16 or earlier, so that the vulnerable WMF import code parses it. The specific feature is the WMF graphics import filter. Limiting factors: user interaction is mandatory (no server-side or automatic trigger is described), the flaw is in a client-side file parser, and systems updated to 4.1.17 are not affected. The exact malformed-structure trigger is not described in the available sources; only that a crafted WMF causes the invalid access. |
| Impact | No CVSS vector, EPSS score, KEV entry, or SSVC decision data is provided - the vuln.today priority is explicitly 'awaiting_data', so quantitative exploitation signals are absent and cannot be compared. The vendor (Apache) rates this 'important'. Risk must therefore be reasoned from the mechanism: an out-of-bounds/uncontrolled memory access in the WMF image-import path of Apache OpenOffice, triggered by opening or processing a crafted WMF file. This requires victim interaction (opening a malicious document or image), which substantially limits it versus a remote unauthenticated server flaw. The stated impact is a program crash or memory corruption; the sources do NOT confirm arbitrary code execution, so treating this as confirmed RCE would overstate it. There is no exploitation probability (EPSS) and no exploit evidence, so this reads as a real but user-interaction-gated client-side parsing bug rather than a drive-by mass-exploitation priority. Priority should track patch availability (fixed in 4.1.17) more than any live-threat signal, since none is present. |
| Exploit ScenarioDerived | An attacker emails or hosts a crafted WMF file (or a document embedding one) and lures a victim into opening it in Apache OpenOffice 4.1.16 or earlier. The malformed WMF triggers an out-of-bounds memory access in the import code, crashing the application or corrupting memory. No public exploit code has been identified at time of analysis, and the sources do not confirm the corruption is controllable enough for code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Opening a crafted WMF (Windows Metafile) image in Apache OpenOffice 4.1.16 or earlier can drive the WMF import filter into an out-of-bounds memory access, crashing the application or corrupting memory. The independently assessed CVSS v3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H, reflecting low confidentiality and integrity impact with high availability impact, and the assessed exploitation condition is that the victim must open or process an attacker-supplied WMF, either standalone or embedded in a document. The issue is fixed in Apache OpenOffice 4.1.17, announced 2026-10-14; no CISA KEV entry, no confirmed public exploit code, and no EPSS score were supplied, and the vuln.today priority is 'awaiting_data', so exploitation likelihood cannot be quantified from the available intelligence.
RemediationAI
The vendor's stated fix is to upgrade to Apache OpenOffice 4.1.17, which the project announced as released on 2026-10-14; binaries and source are available from https://openoffice.apache.org/, with the advisory mirrored at https://seclists.org/oss-sec/2026/q4/504 and the record at https://www.cve.org/CVERecord?id=CVE-2026-90629. No separate workaround, configuration switch or filter-disable option is documented in the supplied sources, and the advisory recommends the upgrade as the remedy. Because the assessed trigger is a user opening or importing an attacker-supplied WMF, standalone or embedded in a document, limiting the handling of untrusted WMF and office documents on unpatched 4.1.16-and-earlier installations reduces exposure until 4.1.17 is deployed, but this is an exposure-reduction measure rather than a vendor-documented fix and does not remove the underlying out-of-bounds access.
Affected ProductsAI
Apache OpenOffice versions through 4.1.16 (that is, 4.1.16 and all earlier releases) contain the vulnerable WMF import code; no CPE identifiers were supplied with the CVE data, so version scoping relies on the vendor's 'through 4.1.16' statement covering the Windows, Linux and macOS builds distributed by the project. The fix ships in Apache OpenOffice 4.1.17, announced on the project site on 2026-10-14, and installations at that level are not affected. Primary references are the oss-security advisory at https://seclists.org/oss-sec/2026/q4/504, the project site and download page at https://openoffice.apache.org/, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-90629. The flaw was credited to Anthropic and Ada Logics.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WMF is Microsoft's Windows Metafile graphics format, a record-based container of GDI drawing calls that office suites render for legacy clip-art and embedded images. The affected component is Apache OpenOffice's WMF graphics import filter, which parses such records when a WMF is opened or imported, including a WMF embedded inside a document. The flaw is an out-of-bounds / uncontrolled memory access during that parsing, so a maliciously structured metafile can cause an invalid read or write leading to a crash or memory corruption; the record in the supplied data carries no CWE assignment (CWE: N/A) and the sources do not describe the specific malformed structure that triggers the invalid access, only that a crafted WMF is required. No CPE strings were provided, so affected-version scoping rests on the vendor statement of 'through 4.1.16' rather than on formal CPE matching; the project ships binaries for Windows, Linux and macOS. Consistent with the assessed conditions, the vector is AV:L with UI:R, matching a client-side file parser that is reached only when a user opens an attacker-supplied file rather than through a network service.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
A user must open a crafted local file so AV:L/UI:R/PR:N; availability impact is high (crash) with limited confidentiality/integrity from possible memory corruption not confirmed as code execution.
Description PRE-NVD
Executive ViewAI
A critical memory safety flaw in Apache OpenOffice 4.1.16 and earlier can be triggered when users open a specially crafted WMF image, causing application crashes and potential memory corruption. The vulnerability requires user interaction and is not known to be actively exploited, but a malicious file could lead to data integrity issues and service disruption for teams relying on OpenOffice for document processing. Security management should ensure the patched version (4.1.17) is deployed to reduce operational risk.
Vendor-released patch: Apache OpenOffice 4.1.17
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
GitHub PoC
Exploit-DB