Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted encrypted PDF to victim
-
DeliveryUser opens/imports PDF in OpenOffice
-
ExploitTrigger out-of-bounds write in PDF import
-
ExecutionCorrupt memory or crash process
-
ImpactPotential code execution in user context
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires a victim to open or import an attacker-crafted ENCRYPTED PDF through Apache OpenOffice's PDF import code path (version ≤4.1.16); the OOB write occurs during that import parsing. Limiting factors: it is not remote/unauthenticated network-reachable - it needs user interaction (the user must open the malicious file) and local delivery of the file to the target, and it only affects installations still running 4.1.16 or earlier. There is no indication of a non-default configuration requirement beyond use of the PDF import feature, which ships with the product. |
| Impact | No quantitative risk signals were supplied: CVSS score and vector are N/A, there is no EPSS probability, no CISA KEV listing, and no SSVC technical-impact/automatable data - the vuln.today Decision label is explicitly 'awaiting_data', so this is currently an unscored, undecided item rather than a confirmed high-priority emergency. The vendor (Apache) rates it 'important'. Based on the description alone, this is a client-side, file-parsing out-of-bounds write reachable only when a user opens/imports a crafted encrypted PDF, so real-world risk is gated by user interaction and local file delivery rather than remote, unauthenticated reachability - it is not a mass-exploitable server flaw. The flaw was reported through Trend/ZDI, a credible source for memory-corruption bugs, which raises the plausibility of exploitability, but no public exploit or PoC reference is included in the input and there is no evidence of active exploitation. Net: a genuine memory-corruption defect worth patching on endpoints that process untrusted PDFs, but on current data it is a user-interaction-dependent client bug, not a confirmed widely-exploited priority; EPSS/KEV/CVSS are all MISSING and should be reconciled once published. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted encrypted PDF and convinces a victim to open or import it in Apache OpenOffice (≤4.1.16). Parsing the malicious PDF triggers an out-of-bounds write, crashing the application or corrupting memory, which could potentially be developed into code execution in the user's context. Exploitation requires the victim to actively open the attacker-supplied file; no public exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
An out-of-bounds memory write in the PDF import code of Apache OpenOffice allows a crafted PDF to crash the application or corrupt memory when a user opens or imports the file. All releases through 4.1.16 are affected; the vendor shipped OpenOffice 4.1.17 on 2026-10-14 to correct the flaw. Exploitation requires the victim to open a malicious encrypted PDF (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H per independent assessment), so there is no network-reachable attack path: no public exploit code was identified at time of analysis and there is no CISA KEV listing or EPSS data, leaving the item unscored and marked 'awaiting_data' by vuln.today.
RemediationAI
Vendor-released patch: Apache OpenOffice 4.1.17, which the project announced on 2026-10-14 and which the advisory states fixes this issue; users on 4.1.16 or any earlier release should upgrade to 4.1.17 (or later) from https://openoffice.apache.org/ and review the release notes for that version. The oss-security advisory (https://seclists.org/oss-sec/2026/q4/507) and the project site are the authoritative sources; the advisory as provided recommends upgrading as the remedy and does not document a configuration workaround or a way to disable the PDF import path, so no vendor-endorsed compensating control can be cited. Because exploitation requires the user to open or import an attacker-crafted encrypted PDF, exposure is limited to installations that still process untrusted PDF attachments with the affected versions until the upgrade is applied.
Affected ProductsAI
Apache OpenOffice versions through and including 4.1.16 are affected, across the Windows, Linux and macOS builds the project distributes (plus community ports such as FreeBSD and OS/2), since the PDF import capability ships with the product rather than being an optional add-on. The flaw is fixed in Apache OpenOffice 4.1.17, announced by the project on 2026-10-14 (the preceding 4.1.16 release dates to 2025-11-10). No CPE strings were included in the supplied data, so identification must rely on product and version rather than CPE matching. Vendor information is at https://openoffice.apache.org/ and the advisory thread at https://seclists.org/oss-sec/2026/q4/507.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache OpenOffice is the Apache Software Foundation's free productivity suite, consisting of a word processor, spreadsheet, presentation, drawing, equation editor and database, released for Windows, Linux and macOS. The vulnerable component is the application's PDF import code path, which parses PDF documents including encrypted (password-protected) files so their contents can be opened and edited; the flaw is reachable during that import parsing. The advisory classifies the defect as an uncontrolled memory access leading to an out-of-bounds memory write, and no CWE identifier was supplied in the available data; the underlying root cause and the exact memory-access mechanism are not described in the sources. Impact per the vendor is a program crash or memory corruption, and the independent assessment scores confidentiality, integrity and availability all as High with scope unchanged, which is consistent with an in-process write primitive inside the importing application. The trigger is not described in the available sources beyond the requirement that a crafted encrypted PDF be imported through OpenOffice's PDF import code on version 4.1.16 or earlier.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
File-parsing bug needing a local crafted PDF opened by the user, so AV:L and UI:R, PR:N; availability impact is confirmed (crash) and the OOB write memory-corruption primitive plausibly supports high confidentiality/integrity, though code execution is unconfirmed.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Description PRE-NVD
Executive ViewAI
Apache OpenOffice releases through 4.1.16 contain an out-of-bounds memory write vulnerability (CVE-2026-90634) that can be triggered when a user opens a specially crafted PDF, potentially leading to memory corruption or application crashes. The vendor has released OpenOffice 4.1.17 to fix the flaw, but until all users are upgraded, the organization faces risks to data confidentiality, integrity, and availability. Leadership should prioritize patching to avoid potential disruptions and data compromise, though no active exploitation has been observed.
Apply vendor patch: upgrade to OpenOffice 4.1.17. Until patched, restrict opening PDFs from untrusted sources and educate users on the risks.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
GitHub PoC
Exploit-DB