Cyber ·
CVE-2026-90632: Apache OpenOffice lets a document read local files via GStreamer plugin
A flaw in Apache OpenOffice up to version 4.1.16 lets a crafted document load local files and include them when the document is saved or exported, for example as PDF. Advisory dated 3 November 2026.
According to the advisory posted on the oss-sec list by Arrigo Marchiori on 3 November 2026, CVE-2026-90632 affects Apache OpenOffice up to version 4.1.16 and is rated important. The flaw is in the GStreamer multimedia component: a document crafted for this purpose can load the contents of any local file and include them in the document when it is saved or exported, for example as PDF.
The source text is a machine translation and advises users to update the software to the version indicated, but the fixed version number is cut off in the copy consulted. To confirm which version resolves the issue, check the original advisory on the oss-sec list and the release notes of the Apache OpenOffice project.
Relevance for your organization: documents received from third parties can expose local file contents of whoever opens and exports them, which may include personal data and credentials stored on disk. Rota Nacional does not fix OpenOffice or GStreamer, and this advisory does not describe any platform feature as a solution.
If you use AI to study or summarize this advisory, do not paste internal documents, spreadsheets or passages containing personal data into the chat. Use only the public text of the advisory. In flows with sensitive data, Rota Nacional detection can apply placeholder markers, removal or a block according to the organization's policy, but that protection does not replace updating the software.