Cyber ·
CVE-2026-90629: out-of-bounds memory access during WMF import in Apache OpenOffice
Important-severity flaw in Apache OpenOffice up to version 4.1.16: a crafted WMF file can cause a crash or memory corruption. The fix is in version 4.1.17, as stated in the November 3, 2026 disclosure.
The disclosure, published on November 3, 2026 on the oss-sec list, describes CVE-2026-90629 in the WMF import code of Apache OpenOffice. According to the text, uncontrolled memory access lets a WMF file crafted for this purpose cause invalid memory access, resulting in a program crash or memory corruption. Affected versions are those up to 4.1.16, the severity is rated important, and the credit line names two discovery groups. The recommendation is to update to version 4.1.17, which fixes the issue.
For anyone using AI to study or apply this topic, the privacy angle is secondary and does not change the fix. Do not send WMF files of unknown origin to tools for analysis, nor documents containing personal or confidential data. Check the installed OpenOffice version and confirm the update through the project's official channel, consulting the original advisory via the disclosure channel named in the source.