Stack Overflow Risk in PDF Export Code of Apache OpenOffice
CVE-2026-90628

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Openoffice
Vendor
CVE Published:
4 November 2026

What is CVE-2026-90628?

The PDF export functionality in Apache OpenOffice versions prior to 4.1.17 contains an uncontrolled memory access vulnerability. This flaw arises from improper handling of crafted CFF fonts, which can lead to a stack overflow, potentially resulting in the application crashing, causing memory corruption or allowing an attacker to execute arbitrary code. Users are strongly advised to update to version 4.1.17 to mitigate this vulnerability.

Affected Version(s)

Apache OpenOffice 0 <= 4.1.16

References

https://lists.apache.org/thread.html/15onpdrzqny5y5qtmdv4...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anthropic and Ada Logics
.