Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-90634

Apache Openoffice: out-of-bounds write can lead to denial of service

Risk score
44/100
CVSS
7.3 v3.1
Published
4 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Affected
Apache Openoffice before 4.1.17
Fix
Upgrade Apache Openoffice to 4.1.17 or later.
Exploitation
No known exploitation

Story map

Story map: Apache OpenofficeTHE FLAWSTHE FIXCVE-2026-90634Out-of-bounds write can leadto denial of serviceCVSS 7.3CVE-2026-59267Heap buffer overflow can leadto denial of serviceCVSS 7.8CVE-2026-90628Stack buffer overflow can leadto denial of serviceCVSS 7.3CVE-2026-90629Out-of-bounds write can leadto denial of serviceCVSS 7.3Upgrade Apache Openoffice4.1.17or later on your release lineWho is exposedApache Openoffice before 4.1.17YELLOW · PLAN IT INApache OpenofficeA crafted DXF document causesa heap buffer overflow in Drawin Apache OpenOffice 4.1.16 andearlier. This could cause a crashor otherwise a corruption ofmemory areas. Users arerecommended to upgrade to…Where it standsNo known exploitationCONNECTS TOSame weaknessOut-of-bounds write (CWE-787)398 other warnings in 30 days →Same productEarlier Apache Openoffice warnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache Openoffice: Yellow, plan it in. A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

The flaws

  • CVE-2026-90634: Out-of-bounds write can lead to denial of service (CVSS 7.3)
  • CVE-2026-59267: Heap buffer overflow can lead to denial of service (CVSS 7.8)
  • CVE-2026-90628: Stack buffer overflow can lead to denial of service (CVSS 7.3)
  • CVE-2026-90629: Out-of-bounds write can lead to denial of service (CVSS 7.3)

The fix

Upgrade Apache Openoffice: 4.1.17 or later on your release line

Who is exposed: Apache Openoffice before 4.1.17

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.3 high

References

Original description

An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Last activity 4 Nov 2026. Patch Forecast updates every hour.