Apache OpenOffice: Local file inclusion via GStreamer plugin
Summary
| CVE | CVE-2026-90632 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-04 11:17:19 UTC |
| Updated | 2026-11-04 11:17:19 UTC |
| Description | Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF. Users are recommended to upgrade to version 4.1.17, which fixes this issue. |
Risk And Classification
Problem Types: CWE-552 | CWE-552 CWE-552 Files or directories accessible to external parties
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache OpenOffice | affected 4.1.16 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.apache.org/thread.html/9rrjtmlnmg47m6soyrl83rz28dbsyqvk | [email protected] | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Edoardo Geraci and Thomas Rinsma of Codean Labs (en)
There are currently no legacy QID mappings associated with this CVE.