CVE-2026-59265

A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase. Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.

• CWE-426

• https://github.com/apache/openoffice/commit/95923fd437e06edd38a4f0e139a27c755a6f3ba6.patch
• https://github.com/apache/openoffice/commit/c699bed3f75e79bd64ddec9dec49f9e210eed281.patch
• https://lists.apache.org/thread.html/svfdc1jtpqlw7mo6lgg9fthcmf754pl5
• https://www.openwall.com/lists/oss-security/2026/10/02/2
• https://www.openwall.com/lists/oss-security/2026/10/08/7

Published

Oct 2, 2026

Last Modified

Oct 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5926IBM Verify Identity Access Container 11.0 through 11.0.2 and…6.5
• CVE-2026-59260OpenWrt luci-app-samba4 read ACL grants file.exec permission…8.8
• CVE-2026-59261OpenClaw before 2026.5.28 contains a credential exposure vul…6.5
• CVE-2026-59262AFFiNE's histories GraphQL field fails to validate Doc.Read …6.5
• CVE-2026-59263A manipulated document opened in Apache OpenOffice 4.1.16 or…5.5
• CVE-2026-59264The Windows installers of Apache OpenOffice 4.1.16 and earli…7.8
• CVE-2026-59267A crafted DXF document causes a heap buffer overflow in Draw…7.8
• CVE-2026-59268An out-of-bounds Write vulnerability in Apache OpenOffice ve…7.3
• CVE-2026-59269A user authenticating to Kubernetes clusters via the Pinnipe…3.8
• CVE-2026-59270Spring Security's embedded UnboundID LDAP server (UnboundIdC…9.1
• CVE-2026-59271When the RabbitMQ management aliveness check fails, the conf…6.5
• CVE-2026-59272Any application shipping logs to RabbitMQ over TLS via the L…6.8