Heap Buffer Overflow in Apache OpenOffice Affects Multiple Versions
CVE-2026-59267

5.8MEDIUM

Key Information:

Vendor

Apache
Status
Apache Openoffice
Vendor
CVE Published:
4 November 2026

What is CVE-2026-59267?

A crafted DXF document can trigger a heap buffer overflow in Apache OpenOffice, leading to potential crashes and memory corruption. Users are urged to upgrade to version 4.1.17 or later to safeguard against this vulnerability. Notably, the affected versions prior to 4.1.17 are susceptible, necessitating prompt action to ensure system integrity and user data protection.

Affected Version(s)

Apache OpenOffice 0 <= 4.1.16

References

https://lists.apache.org/thread.html/pwcm02dq2cy42qq2owzl...
vendor-advisory

CVSS V4

Score:
5.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trail of Bits, in collaboration with Anthropic
.