Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-59268— Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader

Quick assessment

Affected

Apache Software Foundation Apache OpenOffice

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache OpenOffice 4.1.16 及更早版本中存在一个越界写入漏洞，攻击者可利用该漏洞构造恶意的 Microsoft Word 文档，导致程序崩溃或破坏其他内存区域。建议用户升级至已修复此问题的 4.1.17 版本。

AI Predicted 8.8 Difficulty: Moderate Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Updated Nov 04, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader

Source: CVE Program / CVE List V5

Vulnerability Description

An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache OpenOffice	0 ~ 4.1.16	-

II. Public POCs for CVE-2026-59268

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-59268

请登录查看更多情报信息。

Other References for CVE-2026-59268 (1)

https://lists.apache.org/thread.html/xw6x0y35f3qlk4pqsc1pf0sv7481yvlk vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-59268

Same Patch Batch · Apache Software Foundation · 2026-11-04 · 23 CVEs total

CVE-2026-115448	8.7 HIGH	Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render
CVE-2026-100300	8.7 HIGH	Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node
CVE-2026-100252	8.6 HIGH	Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied a
CVE-2026-100302	7.1 HIGH	Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead reque
CVE-2026-100235	6.0 MEDIUM	Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an
CVE-2026-59267	5.8 MEDIUM	Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corrup
CVE-2026-59263	1.9 LOW	Apache OpenOffice: Carefully crafted documents could display different data when opened wi
CVE-2026-108500		Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
CVE-2026-103582		Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache
CVE-2026-108946		Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id m
CVE-2026-111822		Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live
CVE-2026-108949		Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer request
CVE-2026-59264		Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer
CVE-2026-90624		Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulne
CVE-2026-90626		Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
CVE-2026-90627		Apache OpenOffice: Local file inclusion via SQL provider and flat file database references
CVE-2026-90628		Apache OpenOffice: Stack overflow in CFF hint handling
CVE-2026-90629		Apache OpenOffice: Out of bounds memory access during WMF import
CVE-2026-90631		Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment var
CVE-2026-90634		Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files

Showing top 20 of 23 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache OpenOffice

Same vendor: Apache Software Foundation

Same weakness: CWE-787