CVE-2026-90626 · Package
NO FIX YET · SEE WHAT TO DO
Apache OpenOffice versions through 4.1.16 mishandle memory while importing PDF files, so a crafted PDF can write outside a buffer. The result is a program crash or memory corruption, and the sources do not say whether code execution is possible.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Anyone who opens PDF files in Apache OpenOffice 4.1.16 or earlier through its PDF import feature is exposed. Systems that do not use OpenOffice or never import PDFs into it can skip it.
Not affected if no-pdf-import, openoffice-not-installed
Who cares desktop, openoffice, pdf-import
4.1.16 are affected4.1.17An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.