{"id":"CVE-2026-90626","kind":"vulnerability","aliases":["CVE-2026-90626"],"related":[],"title":"Apache OpenOffice: crafted PDF import causes memory corruption and crashes","description":"An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","summary":"Apache OpenOffice versions through 4.1.16 mishandle memory while importing PDF files, so a crafted PDF can write outside a buffer. The result is a program crash or memory corruption, and the sources do not say whether code execution is possible.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","openoffice","package","pdf-import"],"not_affected_if":["no-pdf-import","openoffice-not-installed"],"how_to_check":"- Check the installed OpenOffice version in Help > About (the sources do not name a specific command)\n- Versions up to and including `4.1.16` are affected","fix":"- Apache OpenOffice: upgrade to `4.1.17`","status":"open","published_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","triaged_at":"2026-11-04T11:27:42+00:00","updated_at":"2026-11-04T11:27:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T11:27:42Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OpenOffice: upgrade to `4.1.17`","reach":"local","title":"Apache OpenOffice: crafted PDF import causes memory corruption and crashes","impact":"medium","summary":"Apache OpenOffice versions through 4.1.16 mishandle memory while importing PDF files, so a crafted PDF can write outside a buffer. The result is a program crash or memory corruption, and the sources do not say whether code execution is possible.","audience":"everyone","category":"package","nicknames":[],"who_cares":["openoffice","desktop","pdf-import"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Program crash or memory corruption when a crafted PDF is opened","analyst_note":"","how_to_check":"- Check the installed OpenOffice version in Help > About (the sources do not name a specific command)\n- Versions up to and including `4.1.16` are affected","plain_action":"Update Apache OpenOffice to version 4.1.17 or later.","needs_analyst":false,"not_affected_if":["no-pdf-import","openoffice-not-installed"],"who_is_affected":"Anyone who opens PDF files in Apache OpenOffice 4.1.16 or earlier through its PDF import feature is exposed. Systems that do not use OpenOffice or never import PDFs into it can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":4126,"output_tokens":509,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-90626':13A,16A '4.1.16':27B,77C '4.1.17':104C 'access':66C 'allow':78C 'apach':1A,23B,73C 'bound':88C 'buffer':42B 'caus':6A,83C,91C 'code':59B,71C 'corrupt':8A,51B,96C 'craft':3A,36B,80C 'crash':10A,48B,93C 'cve':11A,14A 'desktop':17B 'execut':60B 'file':33B 'fix':106C 'import':5A,22B,31B,70C 'issu':108C 'memori':7A,29B,50B,65C,89C,95C 'mishandl':28B 'openoffic':2A,18B,24B,74C 'out-of-bound':85C 'outsid':40B 'packag':19B 'pdf':4A,21B,32B,37B,69C,81C 'pdf-import':20B 'possibl':62B 'program':47B,92C 'recommend':99C 'result':44B 'say':57B 'sourc':54B 'uncontrol':64C 'upgrad':101C 'user':97C 'version':25B,75C,103C 'whether':58B 'write':39B,90C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens PDF files in Apache OpenOffice 4.1.16 or earlier through its PDF import feature is exposed. Systems that do not use OpenOffice or never import PDFs into it can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Apache OpenOffice to version 4.1.17 or later.","pkeys":[],"ptokens":[],"labels":["desktop","medium","openoffice","package","pdfimport"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90626","severity":null,"published_at":"2026-11-04T11:17:19+00:00","modified_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","fetched_at":"2026-11-04T11:26:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}