Apache OpenOffice CVE-2026-90632

Exploitation requires a victim to (1) open an attacker-crafted Apache OpenOffice document (version 4.1.16 or earlier) that embeds multimedia content processed by the GStreamer component, and (2) save or export that document (for example to PDF), at which point the referenced local file's contents are read and embedded; the attacker then needs the resulting saved/exported file returned to them to actually obtain the data. Limiting factors: active user interaction is mandatory (both opening and save/export), the disclosure is only realized once the output file reaches the attacker, and the flaw is tied to the GStreamer multimedia backend - which is typically the Unix/Linux media framework for OpenOffice (this platform scoping is inferred, not stated in the sources, and should be confirmed with the vendor). Fixed configuration is version 4.1.17; the vendor states upgrading is the recommended fix.

No CVSS, EPSS, KEV, or SSVC data is provided by the sources (vuln.today decision label is 'awaiting_data'), so quantitative exploitation signals are absent rather than low - this is a data gap, not evidence of low risk. The vendor rates it 'important.' Based on an independent reading of the mechanism, real-world risk is moderate: exploitation is a client-side, user-interaction-dependent confidentiality attack (crafted document reads arbitrary local files and embeds them on save/export), not a remotely automatable server compromise. It is not a drop-everything emergency - there is no KEV listing, no EPSS probability, and no public exploit identified - but it is a credible data-exfiltration primitive against anyone who opens untrusted documents, and the practical payoff (silent theft of local file contents such as credentials, keys, or sensitive documents) makes it worth patching promptly. The absence of a vendor/NVD CVSS vector means attack vector and privilege requirements are my assessment, not confirmed fact - verify against NVD once it publishes.

An attacker emails or shares a crafted OpenOffice document whose GStreamer-backed multimedia element references a sensitive local path (e.g., an SSH key, configuration file, or saved credentials). When the victim opens the document and then saves or exports it - for example to PDF - the targeted file's contents are read and embedded into the output. If the victim returns or publishes that saved/exported file, the attacker recovers the exfiltrated data. No public exploit identified at time of analysis.