{"api_version":"1","generated_at":"2026-11-04T13:21:22+00:00","cve":"CVE-2026-59264","urls":{"html":"https://cve.report/CVE-2026-59264","api":"https://cve.report/api/cve/CVE-2026-59264.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-59264","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-59264"},"summary":{"title":"Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer","description":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-04 11:17:16","updated_at":"2026-11-04 11:17:16"},"problem_types":["CWE-427","CWE-427 CWE-427 Use of Uncontrolled Search Path"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread.html/d4n33sjk8jgrr78jj5cq5r51fvxv6nnv","name":"https://lists.apache.org/thread.html/d4n33sjk8jgrr78jj5cq5r51fvxv6nnv","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59264","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59264","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache OpenOffice","version":"affected 4.1.16 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Kazuma Matsumoto, from GMO Cybersecurity by IERAE, Inc.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/openoffice","product":"Apache OpenOffice","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.1.16","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"Kazuma Matsumoto, from GMO Cybersecurity by IERAE, Inc."}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.<br>Users are recommended to upgrade to version 4.1.17, which fixes this issue."}],"value":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue."}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-427","description":"CWE-427 Use of Uncontrolled Search Path","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-04T11:02:42.505Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/d4n33sjk8jgrr78jj5cq5r51fvxv6nnv"}],"source":{"discovery":"EXTERNAL"},"title":"Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-59264","datePublished":"2026-11-04T11:02:42.505Z","dateReserved":"2026-07-04T15:34:24.392Z","dateUpdated":"2026-11-04T11:02:42.505Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-04 11:17:16","lastModifiedDate":"2026-11-04 11:17:16","problem_types":["CWE-427","CWE-427 CWE-427 Use of Uncontrolled Search Path"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"59264","Ordinal":"1","Title":"Apache OpenOffice: Uncontrolled search path element vulnerabilit","CVE":"CVE-2026-59264","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"59264","Ordinal":"1","NoteData":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","Type":"Description","Title":"Apache OpenOffice: Uncontrolled search path element vulnerabilit"}]}}}