7.3High
CVE-2026-90634Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
Description
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Weakness (CWE):
CWE-787
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Apache Software Foundation | Apache OpenOffice | ≤ 4.1.16 | |
| apache | openoffice | < 4.1.17 |
References and patches
- https://lists.apache.org/thread.html/1c0lropx46w8ozwk29p5yw1xlq4wnbll vendor-advisoryMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/11/03/32 Mailing ListThird Party Advisory
CPE matches (NVD) (1)
cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*< 4.1.17