Detections
Analytics

Apache OpenOffice < 4.1.17 Multiple Vulnerabilities

high Nessus Plugin ID 371067

Language:

Synopsis

The remote Windows host has an application installed that is affected by multiple vulnerabilities.

Description

The version of Apache OpenOffice installed on the remote host is prior to 4.1.17. It is, therefore, affected by multiple vulnerabilities:

 - A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. (CVE-2026-59265)

 - The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. (CVE-2026-59264)

 - A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. (CVE-2026-59267)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Apache OpenOffice version 4.1.17 or later.

See Also

https://lists.apache.org/thread/svfdc1jtpqlw7mo6lgg9fthcmf754pl5

https://www.openoffice.org/security/bulletin.html

https://www.openoffice.org/security/cves/CVE-2026-59265.html

http://www.nessus.org/u?3193df7c

Plugin Details

Severity: High

ID: 371067

File Name: openoffice_4117.nasl

Version: 1.6

Type: Local

Agent: windows

Family: Windows

Published: 10/23/2026

Updated: 11/10/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 98.82

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-59265

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2026-59267

CVSS v4

Risk Factor: High

Base Score: 8.8

Threat Score: 7.3

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS Score Source: CVE-2026-59267

Vulnerability Information

CPE: cpe:/a:apache:openoffice

Required KB Items: installed_sw/OpenOffice

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/14/2026

Vulnerability Publication Date: 10/2/2026

Reference Information

CVE: CVE-2026-59263, CVE-2026-59264, CVE-2026-59265, CVE-2026-59267, CVE-2026-59268, CVE-2026-90624, CVE-2026-90626, CVE-2026-90627, CVE-2026-90628, CVE-2026-90629, CVE-2026-90631, CVE-2026-90634

IAVA: 2026-A-1145, 2026-A-1244