{"id":"CVE-2026-90629","kind":"vulnerability","aliases":["CVE-2026-90629"],"related":[],"title":"Apache OpenOffice: crafted WMF file can crash it or corrupt memory","description":"An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","summary":"Apache OpenOffice versions through 4.1.16 have an uncontrolled memory access in the WMF image import code. A crafted WMF file can crash the program or corrupt its memory.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","openoffice","package","wmf"],"not_affected_if":["no-untrusted-files","not-openoffice"],"how_to_check":"- Check the installed OpenOffice version in Help > About; versions through `4.1.16` are affected.","fix":"- Apache OpenOffice: upgrade to `4.1.17`.","status":"open","published_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","triaged_at":"2026-11-04T11:27:40+00:00","updated_at":"2026-11-04T11:27:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T11:27:40Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OpenOffice: upgrade to `4.1.17`.","reach":"local","title":"Apache OpenOffice: crafted WMF file can crash it or corrupt memory","impact":"medium","summary":"Apache OpenOffice versions through 4.1.16 have an uncontrolled memory access in the WMF image import code. A crafted WMF file can crash the program or corrupt its memory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openoffice","desktop","wmf"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Program crashes or memory is corrupted when a crafted file opens","analyst_note":"","how_to_check":"- Check the installed OpenOffice version in Help > About; versions through `4.1.16` are affected.","plain_action":"","needs_analyst":false,"not_affected_if":["not-openoffice","no-untrusted-files"],"who_is_affected":"Anyone running Apache OpenOffice up to and including 4.1.16 who opens WMF image files, including files received by email or downloaded from the web. Systems that do not run OpenOffice or never open untrusted documents are less exposed. The sources do not state whether code execution is possible, only crash or memory corruption.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":4123,"output_tokens":476,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-90629':14A,17A '4.1.16':26B,64C '4.1.17':89C 'access':31B,53C,75C 'allow':65C 'apach':1A,22B,60C 'caus':71C,76C 'code':37B,58C 'corrupt':10A,47B,81C 'craft':3A,39B,67C 'crash':7A,43B,78C 'cve':12A,15A 'desktop':18B 'file':5A,41B,69C 'fix':91C 'imag':35B 'import':36B,57C 'invalid':73C 'issu':93C 'memori':11A,30B,49B,52C,74C,80C 'openoffic':2A,19B,23B,61C 'packag':20B 'program':45B,77C 'recommend':84C 'uncontrol':29B,51C 'upgrad':86C 'user':82C 'version':24B,62C,88C 'wmf':4A,21B,34B,40B,56C,68C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Apache OpenOffice up to and including 4.1.16 who opens WMF image files, including files received by email or downloaded from the web. Systems that do not run OpenOffice or never open untrusted documents are less exposed. The sources do not state whether code execution is possible, only crash or memory corruption.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["desktop","medium","openoffice","package","wmf"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90629","severity":null,"published_at":"2026-11-04T11:17:19+00:00","modified_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","fetched_at":"2026-11-04T11:26:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}