Apache OpenOffice: multiple flaws incl. code execution (CVE-2026-90624, CVE-2026-90628) fixed in 4.1.17
CVE-2026-90624 CVE-2026-90626 CVE-2026-90627 CVE-2026-90628 CVE-2026-90629 CVE-2026-90631 CVE-2026-90632 CVE-2026-90634
Published 05/11/2026 02:24
Timeline
4 events over 1 d 3 h
- 03/11/2026 22:49First report+15 h
- 04/11/2026 13:54CorroboratedBSI CERT-Bund (WID)+0 min
- 04/11/2026 13:54ConfirmedBSI CERT-Bund (WID)+12 h
- 05/11/2026 02:24Published on WatchtowerPro CISO
In short
Apache OpenOffice versions up to 4.1.16 contain several flaws, including memory corruption in PDF, WMF and font handling and local file disclosure through crafted documents. Some can lead to running attacker code. Version 4.1.17 fixes them; update and avoid opening untrusted documents until then.
How bad is it
High. An attacker could run their own code on a computer with a vulnerable OpenOffice; the exact conditions an attacker needs are not yet published in the sources.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 8 CVEs · CVSS 3.1 from NVD, from the vendor, read 05/11/2026.
What an attacker needs
- Internet access to itLocal access needed
- A loginNot needed
- A user to clickYes
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Slow it down or interrupt it
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Apache OpenOffice versions before 4.1.17
Fixed in
- 4.1 branch: 4.1.17
What to do now
- Update Apache OpenOffice to version 4.1.17 or later, where your distribution or installer provides it.
- Until you have updated, treat documents from outside your organisation, especially PDF, WMF and database files, as untrusted and do not open them in OpenOffice.
- Answer "No" to any prompt about loading external links.
- These interim measures only reduce exposure; they do not make a system safe. Only the update fixes the flaw.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 10 sources with their dates. And technology matching: which of your systems run Apache OpenOffice, at which version, fixed or not - and what each one needs.
Main sources
[NEU] [mittel] Apache OpenOffice: Mehrere Schwachstellen CERT · CVE-2026-90624: Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability Research · CVE-2026-90626: Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files Research