CVE-2026-59267 · Package
NO FIX YET · SEE WHAT TO DO
A specially crafted DXF drawing file causes a heap buffer overflow in the Draw component of Apache OpenOffice 4.1.16 and earlier. The overflow can crash the program or corrupt memory.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Anyone who opens a DXF file in Draw in Apache OpenOffice 4.1.16 or earlier is exposed, most likely when the file comes from an untrusted source. Systems that do not have OpenOffice installed, or that run 4.1.17 or later, are not affected.
Not affected if no-dxf-import, openoffice-4.1.17-or-later
Who cares desktop, document-handling, openoffice
soffice --version.4.1.16 as affected.4.1.17.A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-59267") · CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.