Cyber ·
CVE-2026-90634: OpenOffice up to 4.1.16 has out-of-bounds write when importing encrypted PDF
Security advisory dated 3 November 2026 about Apache OpenOffice up to version 4.1.16. A crafted encrypted PDF can cause an out-of-bounds write, program crash or memory corruption. Version 4.1.17 fixes the issue.
Advisory CVE-2026-90634 describes uncontrolled memory access in the PDF import code of Apache OpenOffice up to version 4.1.16. According to the description published on the oss-sec feed, a PDF crafted for this purpose can cause an out-of-bounds memory write, leading to program failure or memory corruption. The reported severity is important. The credit names an anonymous researcher working with the TrendAI Zero Day Initiative as discoverer. The advisory recommends updating to version 4.1.17, which fixes the problem. The disclosure was published on 3 November 2026. To consult the original, search for advisory CVE-2026-90634 on the 2026 oss-sec feed or on the official Apache OpenOffice project page, and check the affected version list before deciding on an update. To verify, compare the installed version with 4.1.17 on each workstation. This topic is not a Rota Nacional feature: the platform does not patch third-party software. If your team uses AI to study the advisory or plan the update, do not paste internal file names, network paths, inventories containing personal data or credentials. Remove that data before sending any text to a model.