Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer
Summary
| CVE | CVE-2026-59264 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-04 11:17:16 UTC |
| Updated | 2026-11-04 11:17:16 UTC |
| Description | The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
Risk And Classification
Problem Types: CWE-427 | CWE-427 CWE-427 Use of Uncontrolled Search Path
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache OpenOffice | affected 4.1.16 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.apache.org/thread.html/d4n33sjk8jgrr78jj5cq5r51fvxv6nnv | [email protected] | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Kazuma Matsumoto, from GMO Cybersecurity by IERAE, Inc. (en)
There are currently no legacy QID mappings associated with this CVE.