CVE-2026-59265

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 0.43%
EPSS Percentile: 35.18%
CISA KEV: Not listed

Description

A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed in version 4.1.17, which is in the release candidate phase. Until then, users can mitigate this issue by disabling Java runtime integration in the Preferences dialog. This prevents the attack. If this is not possible, or as an extra precaution, you can avoid opening open untrusted files entirely. Once 4.1.17 is released, upgrade to that version to fix the issue.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security@apache.org
Published: 03-Oct-2026 01:17
Last Modified: 08-Oct-2026 11:17
EPSS Date: 2026-10-10
CWE: CWE-426

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 11-Oct-2026 16:15
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

CVE-2026-105134 (AhsayCBS), CVE-2026-96940 (Microsoft Exchange Server), CVE-2026-63277 (LibreOffice), CVE-2026-59265 (Apache OpenOffice), and multiple vulnerabilities in WordPress. Weekly Cybersecurity Recap Highlights Exploited Atlassian Flaw and Other Threats
Apache OpenOffice has not fixed the matching flaw, which it tracks as CVE-2026-59265. Every version up to and including its current release, 4.1.16, is affected, and the project says a fix is expected in version 4.1.17, LibreOffice and OpenOffice Flaws Let Spreadsheets Run Code Without Macro Warnings

CVE (52)

People (4)

MITRE ATT&CK (1)

Vendors (1)

Products (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.