CVE-2026-59265: apache software foundation apache openoffice Untrusted Search Path

Vulnerability summary

CVE-2026-59265 is a high (CVSS 8.8) Untrusted Search Path vulnerability in apache software foundation apache openoffice. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.7% of scored vulnerabilities.

Timeline

1. 02-10-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase. Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.

• CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.