{"id":"CVE-2026-90628","kind":"vulnerability","aliases":["CVE-2026-90628"],"related":[],"title":"Apache OpenOffice: crafted CFF font in PDF export can run code","description":"An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code.\n\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","summary":"A crafted CFF font inside a document causes a stack overflow in the PDF export code of Apache OpenOffice up to 4.1.16. The overflow can crash the program, corrupt memory, or let an attacker run other code.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","openoffice","package","pdf-export"],"not_affected_if":["no-untrusted-documents","not-using-openoffice"],"how_to_check":"- Check the installed OpenOffice version via Help > About in the application\n- Look for OpenOffice builds at or below `4.1.16` on workstations and build hosts","fix":"- Apache OpenOffice: upgrade to `4.1.17`","status":"open","published_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","triaged_at":"2026-11-04T11:27:41+00:00","updated_at":"2026-11-04T11:27:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T11:27:41Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OpenOffice: upgrade to `4.1.17`","reach":"local","title":"Apache OpenOffice: crafted CFF font in PDF export can run code","impact":"high","summary":"A crafted CFF font inside a document causes a stack overflow in the PDF export code of Apache OpenOffice up to 4.1.16. The overflow can crash the program, corrupt memory, or let an attacker run other code.","audience":"everyone","category":"package","nicknames":[],"who_cares":["openoffice","desktop","pdf-export"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker runs other code on the machine via a crafted document","analyst_note":"","how_to_check":"- Check the installed OpenOffice version via Help > About in the application\n- Look for OpenOffice builds at or below `4.1.16` on workstations and build hosts","plain_action":"Update Apache OpenOffice to version 4.1.17 or later.","needs_analyst":false,"not_affected_if":["not-using-openoffice","no-untrusted-documents"],"who_is_affected":"Anyone who exports documents to PDF in Apache OpenOffice 4.1.16 or earlier, especially when opening untrusted files that contain embedded CFF fonts. Exposure comes from the PDF export path processing the font, so systems that do not run OpenOffice or never export PDFs from it can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4130,"output_tokens":529,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-90628':14A,17A '4.1.16':45B,75C '4.1.17':105C 'access':64C 'allow':76C 'apach':1A,41B,71C 'attack':57B 'caus':31B,82C,87C 'cff':4A,26B,79C 'code':11A,39B,60B,69C,97C 'corrupt':52B,92C 'craft':3A,25B,78C 'crash':49B,89C 'cve':12A,15A 'desktop':18B 'document':30B 'even':94C 'export':8A,23B,38B,68C 'fix':107C 'font':5A,27B,80C 'insid':28B 'issu':109C 'let':55B 'memori':53B,63C,91C 'openoffic':2A,19B,42B,72C 'overflow':34B,47B,85C 'packag':20B 'pdf':7A,22B,37B,67C 'pdf-export':21B 'problem':86C 'program':51B,88C 'recommend':100C 'run':10A,58B,95C 'stack':33B,84C 'uncontrol':62C 'upgrad':102C 'user':98C 'version':73C,104C","nicknames":[],"mitigations":[],"who_affected":"Anyone who exports documents to PDF in Apache OpenOffice 4.1.16 or earlier, especially when opening untrusted files that contain embedded CFF fonts. Exposure comes from the PDF export path processing the font, so systems that do not run OpenOffice or never export PDFs from it can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Apache OpenOffice to version 4.1.17 or later.","pkeys":[],"ptokens":[],"labels":["desktop","high","openoffice","package","pdfexport"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90628","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90628","severity":null,"published_at":"2026-11-04T11:17:19+00:00","modified_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","fetched_at":"2026-11-04T11:26:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}