---
id: "CVE-2026-90632"
kind: "vulnerability"
aliases: ["CVE-2026-90632"]
title: "Apache OpenOffice: crafted document can pull local files into exports"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-openoffice", "desktop", "documents", "package"]
not_affected_if: ["no-untrusted-documents", "version-4.1.17-or-later"]
published_at: "2026-11-04T11:17:19+00:00"
first_seen_at: "2026-11-04T11:26:46+00:00"
updated_at: "2026-11-04T11:27:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90632", "first_seen_at": "2026-11-04T11:26:46+00:00"}]
---

# Apache OpenOffice: crafted document can pull local files into exports

A crafted OpenOffice document can abuse its GStreamer multimedia component to load the contents of any local file. Those contents are then embedded when the document is saved or exported, for example to PDF, so an attacker can read files from the victim's machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenOffice version (Apache OpenOffice Help > About) and see whether it is `4.1.16` or earlier.
- Confirm whether the GStreamer multimedia component is in use on the machine (unknown from the sources).

## Fix

- Apache OpenOffice: upgrade to `4.1.17`

## Timeline

- 2026-11-04T11:26:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90632

## From the sources

Apache OpenOffice documents can include multimedia content (audio, video, etc.)

A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.

Users are recommended to upgrade to version 4.1.17, which fixes this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_