EUVD-2026-91764
GHSA-55r6-rg38-gm55
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious document delivered remotely but requires the victim to open it (AV:N, UI:R); no auth needed (PR:N); default Java integration makes it low-complexity (AC:L) with full RCE impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user.
This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase.
Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.
Articles & Coverage 1
AnalysisAI
Opening a crafted untrusted document in Apache OpenOffice 4.1.16 and earlier can execute arbitrary code at the opening user's privilege level, including code fetched from a remote location, because the document's Java integration fails to authorize the external links it resolves. Exploitation is unauthenticated but requires user interaction: Java runtime integration must be enabled (the default configuration) and the victim must actively open an attacker-supplied file, making social engineering the primary delivery vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that Java runtime integration be enabled in OpenOffice (the default state) AND that the victim actively open an attacker-supplied untrusted document (UI:R) in Apache OpenOffice 4.1.16 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and point to a serious-but-not-urgent issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to Apache OpenOffice 4.1.17 once it is released, which per the vendor advisory is the version that resolves this issue; at the time of analysis only the two upstream fix commits were available (https://github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210eed281.patch and https://github.com/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6f3ba6.patch), so patched binaries were not yet broadly distributed - upstream fix available (PR/commit); released patched version not independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, instruct all users to disable Java runtime integration in Apache OpenOffice via Tools > Options > OpenOffice > Java (uncheck 'Use a Java runtime environment') and to avoid opening untrusted documents; within 7 days, enforce this setting across all endpoints using Group Policy or endpoint management and distribute a security advisory to employees; within 30 days, upgrade to Apache OpenOffice 4.1.17 as soon as it is generally available and monitor the vendor advisory for the final release. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-426 – Untrusted Search Path
View allShare
External POC / Exploit Code
Leaving vuln.today