CVE-2026-90624 - Vulnerability Details

Description

An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Published: 2026-11-04

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

Apache OpenOffice versions through 4.1.16 contain an unchecked memory access in the PDF import module that allows an attacker to craft a PDF file triggering an out-of-bounds write. This write can corrupt memory, crash the application, or serve as a vector for arbitrary code execution.

Affected Systems

Workstations running Apache OpenOffice 4.1.16 or earlier are affected. The issue is fixed in version 4.1.17.

Risk and Exploitability

The CVSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation data. However, the flaw could be used to crash the program or achieve remote code execution if a user opens a malicious PDF, implying the likely attack vector involves social engineering to get the user to view the crafted file.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache OpenOffice

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.1.16

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apache OpenOffice to version 4.1.17 or later.
If an upgrade is not immediately possible, disable PDF import functionality or block malicious PDFs as a temporary control.
Ensure that only trusted, signed PDFs are accessible to users and conduct user training to recognize malicious files.

Generated by OpenCVE AI on November 4, 2026 at 12:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/11/03/25
https://lists.apache.org/thread.html/w1047xm52vyfjt79kw2n0d3ln6sq9g5s

History

Wed, 04 Nov 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/11/03/25

Wed, 04 Nov 2026 11:00:00 +0000

Type	Values Removed	Values Added
Description		An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Title		Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability
Weaknesses		CWE-787
References		https://lists.apache.org/thread.html/w1047xm52vyfjt79kw2n0d3ln6sq9g5s

Subscriptions

No data.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-11-04T11:03:06.309Z

Updated: 2026-11-04T12:13:21.921Z

Reserved: 2026-09-12T20:45:49.601Z

Link: CVE-2026-90624

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-04T11:17:18.970

Modified: 2026-11-04T13:17:32.800

Link: CVE-2026-90624

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-04T13:00:16Z

Weaknesses

CWE-787
Out-of-bounds Write

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90624", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-12T20:45:49.601Z", "datePublished": "2026-11-04T11:03:06.309Z", "dateUpdated": "2026-11-04T12:13:21.921Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-04T11:03:06.309Z"}, "title": "Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability", "problemTypes": [{"descriptions": [{"description": "CWE-787 Out-of-bounds write", "lang": "en", "cweId": "CWE-787", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache OpenOffice", "packageURL": "pkg:software-id/apache.org/openoffice", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "4.1.16", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption.<br>Users are recommended to upgrade to version 4.1.17, which fixes this issue."}]}], "references": [{"url": "https://lists.apache.org/thread.html/w1047xm52vyfjt79kw2n0d3ln6sq9g5s", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Anonymous working with TrendAI Zero Day Initiative", "type": "finder"}, {"lang": "en", "value": "Anthropic and Ada Logics", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/03/25"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-04T12:13:21.921Z"}}]}}

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object