# CVE-2026-90632: Apache OpenOffice file disclosure via GStreamer multimedia handling

Source: https://junglewise.ai/threats/cve-2026-90632-apache-openoffice-documents-can-include-multimedia-content-audio  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-90632 · Severity: info · Published 2026-11-04

Apache OpenOffice, a widely-used office productivity suite, can be tricked by a maliciously crafted document into reading arbitrary files from the user's computer. When the document is saved or exported (for example to PDF), those local files are included in the output, exposing sensitive data such as configuration files or other documents the user has access to.

Technologies: [Apache OpenOffice](https://junglewise.ai/threats/technologies/openoffice). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-90632 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90632 being exploited in the wild.

**How severe is CVE-2026-90632?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Apache OpenOffice through 4.1.16.

**Is there a fix for CVE-2026-90632?** Yes: fixed in 4.1.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90632 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-90632?** Check whether you run Apache OpenOffice at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.1.17

## Technical details

The vulnerability exists in Apache OpenOffice's GStreamer multimedia component, which improperly handles multimedia content embedded in documents. A crafted ODF or related document can be constructed to cause GStreamer to load local files outside the document's sandbox; these files are then included when the user saves or exports the document. The attack requires user interaction (opening and then saving/exporting the document) but does not require special privileges or network access.

## Affected products

- Apache OpenOffice through 4.1.16

## Timeline

- 2026-11-04: disclosed

## References

- [https://lists.apache.org/thread.html/9rrjtmlnmg47m6soyrl83rz28dbsyqvk](https://lists.apache.org/thread.html/9rrjtmlnmg47m6soyrl83rz28dbsyqvk)

## Related threats

- [Apache OpenOffice heap buffer overflow in DXF parsing](https://junglewise.ai/threats/cve-2026-59267-a-crafted-dxf-document-causes-a-heap-buffer-overflow-in-draw-in)
- [Apache OpenOffice out-of-bounds memory write in PDF import](https://junglewise.ai/threats/cve-2026-90634-an-uncontrolled-memory-access-in-the-pdf-import-code-of-apache)
- [Apache OpenOffice external link loading without authorization](https://junglewise.ai/threats/cve-2026-90631-apache-openoffice-documents-can-contain-links-a-missing)
- [Apache OpenOffice memory access violation in WMF import](https://junglewise.ai/threats/cve-2026-90629-an-uncontrolled-memory-access-in-the-wmf-import-code-of-apache)
- [Apache OpenOffice stack overflow in PDF export CFF font parsing](https://junglewise.ai/threats/cve-2026-90628-an-uncontrolled-memory-access-in-the-pdf-export-code-of-apache)