Cyber ·
CVE-2026-90626: Apache OpenOffice, out-of-bounds write when importing encrypted PDF
Important-severity vulnerability in Apache OpenOffice up to version 4.1.16. A specially crafted encrypted PDF can cause an out-of-bounds write, program crash or memory corruption. According to the source, version 4.1.17 fixes the issue.
Advisory dated November 3, according to the source, posted to the oss-sec list, with machine translation of the content. The identifier is CVE-2026-90626 and the stated severity is important. It affects Apache OpenOffice up to version 4.1.16. The description cites uncontrolled memory access in the PDF import code: a PDF crafted for this purpose can cause an out-of-bounds memory write, leading to program failure or memory corruption. The advisory recommends updating to version 4.1.17, which fixes the problem. The credited discoverers are Anthropic and Ada Logics. To verify, consult the original text on the oss-sec list, in the SecLists archive for 2026, quarter 4, message 501, and the official Apache OpenOffice page with the advisory and release notes. Check the installed version on your workstations and apply the update.