CVE-2026-90627 · Package
NO FIX YET · SEE WHAT TO DO
The flat file database driver in Apache OpenOffice through 4.1.16 lets a crafted document read the contents of any local file without asking the user. An attacker who gets a user to open such a document can read files the user can access.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Anyone running Apache OpenOffice through 4.1.16 is exposed, since the flaw is in the flat file database driver that processes documents. The sources do not say which document types or configurations trigger it beyond opening a crafted document, so systems without OpenOffice can skip it.
Not affected if not-installed
Who cares desktop, openoffice
4.1.16 or earlier.4.1.17.The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.