Cyber ·
CVE-2026-90628: stack overflow in OpenOffice when processing CFF fonts
Advisory from the oss-sec list dated November 3, 2026, on a stack overflow in Apache OpenOffice up to version 4.1.16, with possible code execution. The fix is in version 4.1.17.
According to the advisory published on the oss-sec list on November 3, 2026, Apache OpenOffice up to version 4.1.16 contains an uncontrolled memory access in its PDF export code. A specially crafted CFF font can cause a stack overflow. The described result ranges from program crash and memory corruption to execution of other code. The severity is classified as important.
The vendor recommends updating to version 4.1.17, which fixes the problem. The advisory credits the discovery to researchers from two external organizations. The original text is a machine translation; to confirm details, consult the original advisory referenced by the oss-sec list and the official Apache OpenOffice project documentation.
For readers, the relevance lies in any environment that opens documents from untrusted sources and uses OpenOffice to export PDF. Rota Nacional does not patch third-party software and is not part of that update chain.
Original source: CVE-2026-90628: Apache OpenOffice: estouro de pilha no processamento de dicas CFF