Cyber ·
CVE-2026-90624: buffer overflow in Apache OpenOffice when importing PDF
An out-of-bounds write in the PDF import of Apache OpenOffice up to version 4.1.16 can cause program failure or memory corruption. The fix is in version 4.1.17, according to the advisory published on November 3, 2026.
On November 3, 2026, the oss-sec feed published an advisory about Apache OpenOffice up to version 4.1.16. The problem is in PDF import: a file crafted for this purpose can make the program perform an out-of-bounds memory write, causing program failure or memory corruption. The stated severity is important and the identifier is CVE-2026-90624. Credit goes to an anonymous researcher working with a zero-day disclosure program. The recommendation is to update to version 4.1.17, which fixes the issue. The available text is an automatic translation of the original advisory; to verify the details, consult the original advisory by its CVE identifier in a public vulnerability database and compare it with the version installed in your environment. This item is not a Rota Nacional usage guide. The connection to the platform is indirect, because the risk lies in a locally installed document editor. If your team uses AI to study the advisory, send only the public text, never PDFs received from third parties or customer data, since the personal data barrier does not handle hostile files.