CVE-2026-59265

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-59265

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59265.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-59265

Published

2026-10-02T17:34:06Z

Modified

2026-10-04T07:05:10Z

Summary

Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover

Details

A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user.

This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase.

Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.

Database specific

{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-426"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59265.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "last_affected":  "4.1.16"
                },
                {
                    "fixed":  "95923fd437e06edd38a4f0e139a27c755a6f3ba6"
                },
                {
                    "fixed":  "181421139242694b309751fb666406eddc203c50"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/apache/openoffice

Affected ranges

Type

GIT

Repo

https://github.com/apache/openoffice

Events

Introduced

Fixed

95923fd437e06edd38a4f0e139a27c755a6f3ba6

Fixed

c699bed3f75e79bd64ddec9dec49f9e210eed281

Database specific

Show details

{
    "source":  "REFERENCES"
}

Affected versions

Other

AOO4110-GA

AOO4111-GA

AOO4112-GA

AOO4113-GA

AOO4114-GA

AOO4115-GA

AOO4116-GA

AOO417

AOO417-RC1

AOO418-GA

AOO419-GA

AOO419-RC1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59265.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "249367683595601261843513298457838400690",
                "231167443737981274119800014320056993661",
                "338346770630542481246544818828659713027",
                "339155283697459807818586618632148667713",
                "242263861908671610206795498127647063047",
                "227367455803089693044698945039292909004",
                "286825011297791434679678907263739254886",
                "264458190060630856737107088286712000944",
                "51631595426096171465202701284709160275"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-59265-52b313db",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210eed281",
        "target":  {
            "file":  "main/sc/source/ui/docshell/dbdocimp.cxx"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "245545582418439619995171001713555727760",
            "length":  11331
        },
        "id":  "CVE-2026-59265-d8244fc5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210eed281",
        "target":  {
            "file":  "main/sc/source/ui/docshell/dbdocimp.cxx",
            "function":  "ScDBDocFunc::DoImport"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "184326337095401453046532546286355257422",
                "31460777879236111236455495707394529526",
                "248819974324742440970131019002804509351",
                "313214456265352843058082484597657299043",
                "182636520583609082125546612978935360499",
                "103484387435178587380139935840613599273",
                "33529471037527553113939705113139752460"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-59265-e12469ce",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6f3ba6",
        "target":  {
            "file":  "main/jvmaccess/source/classpath.cxx"
        }
    }
]

vanir_signatures_modified

"2026-10-04T07:05:10Z"