7.8High
CVE-2026-59264Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer
Description
The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Weakness (CWE):
CWE-427
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Apache Software Foundation | Apache OpenOffice | ≤ 4.1.16 | |
| apache | openoffice | < 4.1.17 |
References and patches
- https://lists.apache.org/thread.html/d4n33sjk8jgrr78jj5cq5r51fvxv6nnv vendor-advisoryMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/11/03/22 Mailing ListThird Party Advisory
CPE matches (NVD) (1)
cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*< 4.1.17