CVE-2026-90629 · Package
NO FIX YET · SEE WHAT TO DO
Apache OpenOffice versions through 4.1.16 have an uncontrolled memory access in the WMF image import code. A crafted WMF file can crash the program or corrupt its memory.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Anyone running Apache OpenOffice up to and including 4.1.16 who opens WMF image files, including files received by email or downloaded from the web. Systems that do not run OpenOffice or never open untrusted documents are less exposed. The sources do not state whether code execution is possible, only crash or memory corruption.
Not affected if no-untrusted-files, not-openoffice
Who cares desktop, openoffice, wmf
4.1.16 are affected.4.1.17.An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.