{"id":"CVE-2026-90632","kind":"vulnerability","aliases":["CVE-2026-90632"],"related":[],"title":"Apache OpenOffice: crafted document can pull local files into exports","description":"Apache OpenOffice documents can include multimedia content (audio, video, etc.)\n\nA crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.\n\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","summary":"A crafted OpenOffice document can abuse its GStreamer multimedia component to load the contents of any local file. Those contents are then embedded when the document is saved or exported, for example to PDF, so an attacker can read files from the victim's machine.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-openoffice","desktop","documents","package"],"not_affected_if":["no-untrusted-documents","version-4.1.17-or-later"],"how_to_check":"- Check the installed OpenOffice version (Apache OpenOffice Help > About) and see whether it is `4.1.16` or earlier.\n- Confirm whether the GStreamer multimedia component is in use on the machine (unknown from the sources).","fix":"- Apache OpenOffice: upgrade to `4.1.17`","status":"open","published_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","triaged_at":"2026-11-04T11:27:37+00:00","updated_at":"2026-11-04T11:27:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T11:27:37Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OpenOffice: upgrade to `4.1.17`","reach":"local","title":"Apache OpenOffice: crafted document can pull local files into exports","impact":"medium","summary":"A crafted OpenOffice document can abuse its GStreamer multimedia component to load the contents of any local file. Those contents are then embedded when the document is saved or exported, for example to PDF, so an attacker can read files from the victim's machine.","audience":"everyone","category":"package","nicknames":[],"who_cares":["apache-openoffice","desktop","documents"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Local files are read and embedded into saved or exported documents","analyst_note":"","how_to_check":"- Check the installed OpenOffice version (Apache OpenOffice Help > About) and see whether it is `4.1.16` or earlier.\n- Confirm whether the GStreamer multimedia component is in use on the machine (unknown from the sources).","plain_action":"Update Apache OpenOffice to version 4.1.17 or later.","needs_analyst":false,"not_affected_if":["version-4.1.17-or-later","no-untrusted-documents"],"who_is_affected":"Anyone who opens untrusted OpenOffice documents on a version through 4.1.16 is exposed, since a crafted file is what triggers the flaw. Teams that only open documents they created, or that run no OpenOffice, can skip it. Whether a non-default configuration is needed is unknown from the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":4146,"output_tokens":563,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-90632':13A,16A '4.1.16':92C '4.1.17':122C 'abus':28B 'apach':1A,18B,68C,88C 'apache-openoffic':17B 'attack':59B 'audio':75C 'compon':32B,86C 'content':36B,42B,74C,96C 'could':81C 'craft':3A,24B,79C 'cve':11A,14A 'desktop':20B 'document':4A,21B,26B,48B,70C,80C,106C 'embed':45B 'etc':77C 'exampl':54B,112C 'exploit':82C 'export':10A,52B,110C 'file':8A,40B,62B,100C 'fix':124C 'gstreamer':30B,84C 'includ':72C,102C 'issu':126C 'load':34B,94C 'local':7A,39B,99C 'machin':67B 'multimedia':31B,73C,85C 'openoffic':2A,19B,25B,69C,89C 'packag':22B 'pdf':56B,114C 'pull':6A 'read':61B 'recommend':117C 'save':50B,108C 'upgrad':119C 'user':115C 'version':90C,121C 'victim':65B 'video':76C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens untrusted OpenOffice documents on a version through 4.1.16 is exposed, since a crafted file is what triggers the flaw. Teams that only open documents they created, or that run no OpenOffice, can skip it. Whether a non-default configuration is needed is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Apache OpenOffice to version 4.1.17 or later.","pkeys":[],"ptokens":[],"labels":["apacheopenoffice","desktop","documents","medium","package"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90632","severity":null,"published_at":"2026-11-04T11:17:19+00:00","modified_at":"2026-11-04T11:17:19+00:00","first_seen_at":"2026-11-04T11:26:46+00:00","fetched_at":"2026-11-04T11:26:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}