Description
A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Published: 2026-11-04
Score: 1.9 Low
EPSS: n/a
KEV: No
Impact: Content Manipulation
Action: Upgrade
AI Analysis

Impact

The vulnerability allows an attacker to craft a corrupted document that, when opened with Apache OpenOffice 4.1.16 or earlier, displays substituted content instead of reporting a corruption error. This manipulation can lead to misleading information being presented to the user. The weakness is identified as CWE-349, indicating that malformed input can alter the expected output.

Affected Systems

The affected product is Apache OpenOffice from the Apache Software Foundation. Versions 4.1.16 and earlier are vulnerable; upgrading to 4.1.17 or newer removes the issue.

Risk and Exploitability

The CVSS score is 1.9, classifying the vulnerability as low severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring a user to open a crafted document in OpenOffice. No exploitation conditions beyond document opening are mentioned, and no remote code execution or denial of service is described.

Generated by OpenCVE AI on November 4, 2026 at 12:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch by upgrading to Apache OpenOffice 4.1.17 or newer.
  • Do not open documents from untrusted or unknown sources; treat them as corrupt and discard.
  • Scan or sandbox suspicious documents before opening them to ensure they are not malicious.

Generated by OpenCVE AI on November 4, 2026 at 12:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 13:30:00 +0000

Type Values Removed Values Added
References

Wed, 04 Nov 2026 11:00:00 +0000

Type Values Removed Values Added
Description A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Title Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.
Weaknesses CWE-349
References
Metrics cvssV4_0

{'score': 1.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/S:P/AU:N/R:A/U:Green'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-11-04T12:13:02.586Z

Reserved: 2026-07-04T15:30:40.737Z

Link: CVE-2026-59263

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-04T11:17:16.393

Modified: 2026-11-04T13:17:30.453

Link: CVE-2026-59263

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T12:45:14Z

Weaknesses
  • CWE-349

    Acceptance of Extraneous Untrusted Data With Trusted Data