CVE-2026-90634

An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

• CWE-787

• https://lists.apache.org/thread.html/1c0lropx46w8ozwk29p5yw1xlq4wnbllMailing List, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/11/03/32Mailing List, Third Party Advisory

Published

Nov 4, 2026

Last Modified

Nov 5, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90626An uncontrolled memory access in the PDF import code of Apac…7.3
• CVE-2026-90627The flat file database driver in Apache Openoffice versions …5.5
• CVE-2026-90628An uncontrolled memory access in the PDF export code of Apac…7.3
• CVE-2026-90629An uncontrolled memory access in the WMF import code of Apac…7.3
• CVE-2026-90631Apache OpenOffice documents can contain links. A missing Aut…3.3
• CVE-2026-90632Apache OpenOffice documents can include multimedia content (…5.5
• CVE-2026-9064A flaw was found in 389-ds-base. The get_ldapmessage_control…7.5
• CVE-2026-90647ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through…7.4
• CVE-2026-90648wasm2c in WebAssembly wabt through 1.0.41 allows sandbox esc…7.1
• CVE-2026-9065SureCart version prior to 4.2.1 are vulnerable to authentica…9.3
• CVE-2026-90650The MotoPress Hotel Booking plugin for WordPress is vulnerab…7.2
• CVE-2026-90651Socket Firewall (socketdev/socket-registry-firewall) in regi…8.1