CVE-2026-90632 · Package
NO FIX YET · SEE WHAT TO DO
A crafted OpenOffice document can abuse its GStreamer multimedia component to load the contents of any local file. Those contents are then embedded when the document is saved or exported, for example to PDF, so an attacker can read files from the victim's machine.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Anyone who opens untrusted OpenOffice documents on a version through 4.1.16 is exposed, since a crafted file is what triggers the flaw. Teams that only open documents they created, or that run no OpenOffice, can skip it. Whether a non-default configuration is needed is unknown from the sources.
Not affected if no-untrusted-documents, version-4.1.17-or-later
Who cares apache-openoffice, desktop, documents
4.1.16 or earlier.4.1.17Apache OpenOffice documents can include multimedia content (audio, video, etc.)
A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-90632")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.