Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1122
_____________________________________________________________________

DATE                : 04/11/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache OpenOffice versions prior
                                  to 4.1.17.

====================================================================
https://lists.apache.org/thread.html/p4c4y9pbbtwq546lw2sbz3qw70jbmn21
https://lists.apache.org/thread.html/sdmj148donxrfnyvysg8th7h290qr25z
https://lists.apache.org/thread.html/w08x8honc55dtnp590266o0rjcz7vo6y
https://lists.apache.org/thread.html/p1woldthv7w8yrd0chbttyplfc70g1mb
https://lists.apache.org/thread.html/xtrq7pk7ww25nm9w1qrhzmzmmp2mgjdm
https://lists.apache.org/thread.html/9tld1n0nsrn455z244xz1ct5l0bxp5m4
https://lists.apache.org/thread.html/4c70gxlxqst4c42qk4y08g6kwl6k4yqj
https://lists.apache.org/thread.html/w4yp105kx0owqxs0wgfxnx5to36q94fh
https://lists.apache.org/thread.html/41279hw5szk6lo82z8qyht5ow5ltd317
https://lists.apache.org/thread.html/4m3z118zlonxgjx7ph7zqgnrwvpw5g8b
_____________________________________________________________________

CVE-2026-90632: Apache OpenOffice: Local file inclusion via GStreamer
plugin

Severity: important 

Affected versions:

- Apache OpenOffice through 4.1.16

Description:

Apache OpenOffice documents can include multimedia content (audio,
video, etc.)

A crafted document could exploit the GStreamer multimedia component of
Apache OpenOffice version through 4.1.16 to load the contents of any
local file, and include them when the document is saved or exported,
for example as PDF.

Users are recommended to upgrade to version 4.1.17, which fixes this
issue.

Credit:

Edoardo Geraci and Thomas Rinsma of Codean Labs (finder)

References:

https://openoffice.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-90632

_____________________________________________________________________

CVE-2026-90634: Apache OpenOffice: Out-of-bounds write when importing
encrypted PDF files

Severity: important 

Affected versions:

- Apache OpenOffice through 4.1.16

Description:

An uncontrolled memory access in the PDF import code of Apache
OpenOffice versions through 4.1.16 allows a crafted PDF to cause an
out-of-bounds memory write, causing program crash or memory
corruption.
Users are recommended to upgrade to version 4.1.17, which fixes this
issue.

Credit:

Anonymous working with TrendAI Zero Day Initiative (finder)

References:

https://openoffice.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-90634

_____________________________________________________________________

CVE-2026-90631: Apache OpenOffice: Remote document loaded without
prompt, possibiy leaking environment variables

Severity: important 

Affected versions:

- Apache OpenOffice through 4.1.16

Description:

Apache OpenOffice documents can contain links. A missing
Authorization vulnerability in Apache OpenOffice allowed an
attacker to craft a document that would cause external links to
be loaded without prompt, possibly transferring the contents of
environment variables in the process.

This issue affects Apache OpenOffice: through 4.1.16.


Users are recommended to upgrade to version 4.1.17, which fixes
the issue.

Credit:

Edoardo Geraci and Thomas Rinsma of Codean Labs (finder)

References:

https://openoffice.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-90631
_____________________________________________________________________

CVE-2026-90629: Apache OpenOffice: Out of bounds memory access during
WMF import

Severity: important 

Affected versions:

- Apache OpenOffice through 4.1.16

Description:

An uncontrolled memory access in the WMF import code of Apache
OpenOffice versions through 4.1.16 allows a crafted WMF file to cause
an invalid memory access, causing program crash or memory corruption.
Users are recommended to upgrade to version 4.1.17, which fixes this
issue.

Credit:

Anthropic and Ada Logics (finder)

References:

https://openoffice.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-90629
_____________________________________________________________________

CVE-2026-90628: Apache OpenOffice: Stack overflow in CFF hint handling
Severity: important 

Affected versions:

- Apache OpenOffice through 4.1.16

Description:

An uncontrolled memory access in the PDF export code of Apache
OpenOffice versions through 4.1.16 allows a crafted CFF font to cause
a stack overflow problem, causing program crash or memory corruption,
or even running other code.

Users are recommended to upgrade to version 4.1.17, which fixes this
issue.

Credit:

Anthropic and Ada Logics (finder)

References:

https://openoffice.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-90628
_____________________________________________________________________

CVE-2026-90627: Apache OpenOffice: Local file inclusion via SQL
provider and flat file database references

Severity: important 

Affected versions:

- Apache OpenOffice through 4.1.16

Description:

The flat file database driver in Apache Openoffice versions through
4.1.16 allows a crafted document to read the contents of any local file
without asking the user.

Users are recommended to upgrade to version 4.1.17, which fixes this
issue.

Credit:

Edoardo Geraci and Thomas Rinsma of Codean Labs (finder)

References:

https://openoffice.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-90627

_____________________________________________________________________

CVE-2026-90626: Apache OpenOffice: Out-of-bounds write when importing
encrypted PDF files

Severity: important 

Affected versions:

- Apache OpenOffice through 4.1.16

Description:

An uncontrolled memory access in the PDF import code of Apache
OpenOffice versions through 4.1.16 allows a crafted PDF to cause an
out-of-bounds memory write, causing program crash or memory
corruption.
Users are recommended to upgrade to version 4.1.17, which fixes this
issue.

Credit:

Anthropic and Ada Logics (finder)

References:

https://openoffice.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-90626
_____________________________________________________________________

CVE-2026-90624: Apache OpenOffice: PDF File Parsing Heap based
Buffer-Overflow-Remote Code Execution Vulnerability

Severity: important 

Affected versions:

- Apache OpenOffice through 4.1.16

Description:

An unchecked memory access in the PDF import code of Apache OpenOffice
versions through 4.1.16 on allows a crafted PDF to execute an
out-of-bounds memory write. This could crash the program or cause
memory corruption.
Users are recommended to upgrade to version 4.1.17, which fixes this
issue.

Credit:

Anonymous working with TrendAI Zero Day Initiative (finder)
Anthropic and Ada Logics (finder)

References:

https://openoffice.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-90624
_____________________________________________________________________

CVE-2026-59264: Apache OpenOffice: Uncontrolled search path element
vulnerability in Windows installer

Severity: moderate 

Affected versions:

- Apache OpenOffice through 4.1.16

Description:

The Windows installers of Apache OpenOffice 4.1.16 and earlier allow
an already manipulated system to run external code with elevated
access.
Users are recommended to upgrade to version 4.1.17, which fixes this
issue.

Credit:

Kazuma Matsumoto, from GMO Cybersecurity by IERAE, Inc. (reporter)

References:

https://openoffice.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-59264
_____________________________________________________________________

CVE-2026-59268: Apache OpenOffice: Heap out-of-bounds write in WW8
PLCF reader

Severity: important 

Affected versions:

- Apache OpenOffice through 4.1.16

Description:

An out-of-bounds Write vulnerability in Apache OpenOffice versions
through 4.1.16 could allow an attacker to craft a Microsoft Word
document that would crash the program, or otherwise corrupt other
memory areas.

Users are recommended to upgrade to version 4.1.17, which fixes
this issue.

Credit:

Yukihiro Nakamura (reporter)

References:

https://openoffice.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-59268


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================