{"id":"CVE-2026-59263","kind":"vulnerability","aliases":["CVE-2026-59263"],"related":[],"title":"Apache OpenOffice: crafted document can display substituted content to users","description":"A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","summary":"A manipulated document opened in Apache OpenOffice 4.1.16 or earlier can display substituted content that misleads the user. The sources describe the risk as manipulation of the reader rather than code execution.","severity":"low","cvss":1.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","openoffice","package"],"not_affected_if":["trusted-documents-only","version-4.1.17-or-later"],"how_to_check":"- Check the installed OpenOffice version via Help > About in the application\n- Confirm whether the installed version is `4.1.16` or earlier","fix":"- Upgrade Apache OpenOffice to `4.1.17`","status":"open","published_at":"2026-11-04T11:17:16+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","triaged_at":"2026-11-04T11:27:35+00:00","updated_at":"2026-11-04T11:27:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T11:27:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache OpenOffice to `4.1.17`","reach":"local","title":"Apache OpenOffice: crafted document can display substituted content to users","impact":"low","summary":"A manipulated document opened in Apache OpenOffice 4.1.16 or earlier can display substituted content that misleads the user. The sources describe the risk as manipulation of the reader rather than code execution.","audience":"everyone","category":"package","nicknames":[],"who_cares":["openoffice","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Substituted content is shown to the user, misleading them about document contents","analyst_note":"","how_to_check":"- Check the installed OpenOffice version via Help > About in the application\n- Confirm whether the installed version is `4.1.16` or earlier","plain_action":"Update Apache OpenOffice to version 4.1.17 and do not open suspicious documents.","needs_analyst":false,"not_affected_if":["version-4.1.17-or-later","trusted-documents-only"],"who_is_affected":"People who open untrusted or manipulated documents in Apache OpenOffice 4.1.16 or earlier. Users who only open documents they trust, or who run a newer version, are not exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000651,"input_tokens":4122,"output_tokens":477,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-59263':13A,16A '4.1.16':27B,59C '4.1.17':88C 'allow':63C 'apach':1A,25B,57C 'code':50B 'content':8A,33B,65C 'corrupt':75C 'craft':3A 'cve':11A,14A 'describ':40B 'desktop':17B 'display':6A,31B,68C 'document':4A,22B,54C,73C 'earlier':29B,61C 'execut':51B 'fix':90C 'issu':92C 'manipul':21B,44B,53C,69C 'may':62C 'mislead':35B 'open':23B,55C,80C 'openoffic':2A,18B,26B,58C 'packag':19B 'rather':48B 'reader':47B 'recommend':83C 'risk':42B 'sourc':39B 'substitut':7A,32B,64C 'upgrad':85C 'user':10A,37B,71C,81C 'version':87C","nicknames":[],"mitigations":[],"who_affected":"People who open untrusted or manipulated documents in Apache OpenOffice 4.1.16 or earlier. Users who only open documents they trust, or who run a newer version, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Apache OpenOffice to version 4.1.17 and do not open suspicious documents.","pkeys":[],"ptokens":[],"labels":["desktop","low","openoffice","package"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:A/V:X/RE:X/U:Green","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59263","severity":null,"published_at":"2026-11-04T11:17:16+00:00","modified_at":"2026-11-04T11:17:16+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","fetched_at":"2026-11-04T11:26:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}