CVE-2026-90631 · Package
NO FIX YET · SEE WHAT TO DO
A crafted Apache OpenOffice document can make the program load external links without asking the user first. The load can carry environment variable contents to the linked location.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Anyone running Apache OpenOffice 4.1.16 or earlier who opens documents from untrusted sources. The sources do not say whether server-side or automated document conversion is affected. Teams that only use newer releases or do not open outside documents can skip it.
Not affected if no-untrusted-documents, version-4.1.17-or-later
Who cares desktop, openoffice
4.1.16 and earlier.4.1.17.Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt, possibly transferring the contents of environment variables in the process.
This issue affects Apache OpenOffice: through 4.1.16.
Users are recommended to upgrade to version 4.1.17, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-90631")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.