{"id":"CVE-2026-59267","kind":"vulnerability","aliases":["CVE-2026-59267"],"related":[],"title":"OpenOffice Draw: crafted DXF file overflows heap memory, enabling crashes","description":"A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","summary":"A specially crafted DXF drawing file causes a heap buffer overflow in the Draw component of Apache OpenOffice 4.1.16 and earlier. The overflow can crash the program or corrupt memory.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","document-handling","openoffice","package"],"not_affected_if":["no-dxf-import","openoffice-4.1.17-or-later"],"how_to_check":"- Check the installed OpenOffice version via Help > About in the application, or run `soffice --version`.\n- Treat any version at or below `4.1.16` as affected.","fix":"- Apache OpenOffice: upgrade to `4.1.17`.","status":"open","published_at":"2026-11-04T12:17:06+00:00","first_seen_at":"2026-11-04T12:26:52+00:00","triaged_at":"2026-11-04T12:27:42+00:00","updated_at":"2026-11-04T12:27:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T12:27:42Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OpenOffice: upgrade to `4.1.17`.","reach":"local","title":"OpenOffice Draw: crafted DXF file overflows heap memory, enabling crashes","impact":"medium","summary":"A specially crafted DXF drawing file causes a heap buffer overflow in the Draw component of Apache OpenOffice 4.1.16 and earlier. The overflow can crash the program or corrupt memory.","audience":"everyone","category":"package","nicknames":[],"who_cares":["openoffice","desktop","document-handling"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Program crashes, or attacker corrupts memory on the user's machine.","analyst_note":"","how_to_check":"- Check the installed OpenOffice version via Help > About in the application, or run `soffice --version`.\n- Treat any version at or below `4.1.16` as affected.","plain_action":"Update Apache OpenOffice to version 4.1.17 and avoid opening untrusted DXF files until then.","needs_analyst":false,"not_affected_if":["openoffice-4.1.17-or-later","no-dxf-import"],"who_is_affected":"Anyone who opens a DXF file in Draw in Apache OpenOffice 4.1.16 or earlier is exposed, most likely when the file comes from an untrusted source. Systems that do not have OpenOffice installed, or that run 4.1.17 or later, are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4128,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-59267':13A,16A '4.1.16':41B,67C '4.1.17':89C 'apach':39B,65C 'area':81C 'buffer':32B,60C 'caus':29B,57C,72C 'compon':37B 'corrupt':51B,78C 'could':71C 'craft':3A,25B,54C 'crash':10A,47B,74C 'cve':11A,14A 'desktop':17B 'document':19B,56C 'document-handl':18B 'draw':2A,27B,36B,63C 'dxf':4A,26B,55C 'earlier':43B,69C 'enabl':9A 'file':5A,28B 'fix':91C 'handl':20B 'heap':7A,31B,59C 'issu':93C 'memori':8A,52B,80C 'openoffic':1A,21B,40B,66C 'otherwis':76C 'overflow':6A,33B,45B,61C 'packag':22B 'program':49B 'recommend':84C 'special':24B 'upgrad':86C 'user':82C 'version':88C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens a DXF file in Draw in Apache OpenOffice 4.1.16 or earlier is exposed, most likely when the file comes from an untrusted source. Systems that do not have OpenOffice installed, or that run 4.1.17 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Apache OpenOffice to version 4.1.17 and avoid opening untrusted DXF files until then.","pkeys":[],"ptokens":[],"labels":["desktop","documenthandling","medium","openoffice","package"],"campaign_type":null,"first_public_at":"2026-11-04T12:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59267","severity":null,"published_at":"2026-11-04T12:17:06+00:00","modified_at":"2026-11-04T12:17:06+00:00","first_seen_at":"2026-11-04T12:26:52+00:00","fetched_at":"2026-11-04T12:26:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}