Cyber ·
CVE-2026-59268: out-of-bounds heap write in Apache OpenOffice (WW8 reader)
Out-of-bounds heap write in the WW8 reader of Apache OpenOffice up to version 4.1.16. The fix is in 4.1.17, and the stated severity is important.
According to the advisory posted to the oss-sec list on November 3, 2026, CVE-2026-59268 is an out-of-bounds write in the heap of the WW8 document reader, with PLCF structure, in Apache OpenOffice up to version 4.1.16. A Microsoft Word file crafted for this purpose can make the program crash or corrupt other memory areas. The stated severity is important. The advisory recommends updating to version 4.1.17, which fixes the problem. The discovery is attributed to an external reporter.
The relevance is a reminder that documents received from outside the organization are an attack vector, even when they look ordinary. Rota Nacional does not fix third-party office software. Anyone studying the advisory with AI should use only the public summary, without pasting internal documents, personal data or credentials alongside the text. To verify, confirm the installed version and read the original advisory on the disclosure site indicated by the oss-sec feed, without following third-party links.