# Apache OpenOffice vulnerabilities Source: https://junglewise.ai/threats/technologies/openoffice Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/openoffice.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 20 vulnerabilities in Apache OpenOffice: 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-59267, was published on 4 November 2026. 12 vulnerabilities in the last four weeks, up 1100% on the four before (1). ## Counts - Last 7 days: 0 - Last 30 days: 12 - Last 90 days: 13 - All time: 20 (0 critical, 0 exploited in the wild) ## About Apache OpenOffice Free and open-source office suite compatible with multiple document formats. ## Latest Apache OpenOffice vulnerabilities - [CVE-2026-59267: Apache OpenOffice heap buffer overflow in DXF parsing](https://junglewise.ai/threats/cve-2026-59267-a-crafted-dxf-document-causes-a-heap-buffer-overflow-in-draw-in) (info, published 4 Nov 2026) - [CVE-2026-90634: Apache OpenOffice out-of-bounds memory write in PDF import](https://junglewise.ai/threats/cve-2026-90634-an-uncontrolled-memory-access-in-the-pdf-import-code-of-apache) (info, published 4 Nov 2026) - [CVE-2026-90632: Apache OpenOffice file disclosure via GStreamer multimedia handling](https://junglewise.ai/threats/cve-2026-90632-apache-openoffice-documents-can-include-multimedia-content-audio) (info, published 4 Nov 2026) - [CVE-2026-90631: Apache OpenOffice external link loading without authorization](https://junglewise.ai/threats/cve-2026-90631-apache-openoffice-documents-can-contain-links-a-missing) (info, published 4 Nov 2026) - [CVE-2026-90629: Apache OpenOffice memory access violation in WMF import](https://junglewise.ai/threats/cve-2026-90629-an-uncontrolled-memory-access-in-the-wmf-import-code-of-apache) (info, published 4 Nov 2026) - [CVE-2026-90628: Apache OpenOffice stack overflow in PDF export CFF font parsing](https://junglewise.ai/threats/cve-2026-90628-an-uncontrolled-memory-access-in-the-pdf-export-code-of-apache) (info, published 4 Nov 2026) - [CVE-2026-90627: Apache OpenOffice flat file database driver local file read](https://junglewise.ai/threats/cve-2026-90627-the-flat-file-database-driver-in-apache-openoffice-versions) (info, published 4 Nov 2026) - [CVE-2026-90626: Apache OpenOffice buffer overflow in PDF import](https://junglewise.ai/threats/cve-2026-90626-an-uncontrolled-memory-access-in-the-pdf-import-code-of-apache) (info, published 4 Nov 2026) - [CVE-2026-90624: Apache OpenOffice memory access violation in PDF import](https://junglewise.ai/threats/cve-2026-90624-an-unchecked-memory-access-in-the-pdf-import-code-of-apache) (info, published 4 Nov 2026) - [CVE-2026-59268: Apache OpenOffice out-of-bounds write in Word document parsing](https://junglewise.ai/threats/cve-2026-59268-an-out-of-bounds-write-vulnerability-in-apache-openoffice) (info, published 4 Nov 2026) - [CVE-2026-59264: Apache OpenOffice Windows installer code execution](https://junglewise.ai/threats/cve-2026-59264-the-windows-installers-of-apache-openoffice-4-1-16-and-earlier) (info, published 4 Nov 2026) - [CVE-2026-59263: Apache OpenOffice document content substitution](https://junglewise.ai/threats/cve-2026-59263-a-manipulated-document-opened-in-apache-openoffice-4-1-16-or) (info, published 4 Nov 2026) - [CVE-2026-59265: Apache OpenOffice Java integration remote code execution](https://junglewise.ai/threats/cve-2026-59265-a-code-execution-issue-in-the-java-integration-in-apache) (info, published 2 Oct 2026) - [CVE-2025-64407: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an…](https://junglewise.ai/threats/cve-2025-64407-apache-openoffice-documents-can-contain-links-a-missing) (medium, CVSS 5.3, published 12 Nov 2025) - [CVE-2025-64406: An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash…](https://junglewise.ai/threats/cve-2025-64406-an-out-of-bounds-write-vulnerability-in-apache-openoffice-could) (medium, CVSS 4.3, published 12 Nov 2025) - [CVE-2025-64405: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an…](https://junglewise.ai/threats/cve-2025-64405-apache-openoffice-documents-can-contain-links-a-missing) (high, CVSS 7.5, published 12 Nov 2025) - [CVE-2025-64404: Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache…](https://junglewise.ai/threats/cve-2025-64404-apache-openoffice-documents-can-contain-links-to-other-files-a) (high, CVSS 7.5, published 12 Nov 2025) - [CVE-2025-64403: Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing…](https://junglewise.ai/threats/cve-2025-64403-apache-openoffice-calc-spreadsheet-can-contain-links-to-other) (high, CVSS 8.1, published 12 Nov 2025) - [CVE-2025-64402: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an…](https://junglewise.ai/threats/cve-2025-64402-apache-openoffice-documents-can-contain-links-a-missing) (medium, CVSS 6.5, published 12 Nov 2025) - [CVE-2025-64401: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an…](https://junglewise.ai/threats/cve-2025-64401-apache-openoffice-documents-can-contain-links-a-missing) (high, CVSS 7.5, published 12 Nov 2025) ## Most severe Apache OpenOffice vulnerabilities - [CVE-2025-64403: Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing…](https://junglewise.ai/threats/cve-2025-64403-apache-openoffice-calc-spreadsheet-can-contain-links-to-other) (high, CVSS 8.1, published 12 Nov 2025) - [CVE-2025-64405: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an…](https://junglewise.ai/threats/cve-2025-64405-apache-openoffice-documents-can-contain-links-a-missing) (high, CVSS 7.5, published 12 Nov 2025) - [CVE-2025-64404: Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache…](https://junglewise.ai/threats/cve-2025-64404-apache-openoffice-documents-can-contain-links-to-other-files-a) (high, CVSS 7.5, published 12 Nov 2025) - [CVE-2025-64401: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an…](https://junglewise.ai/threats/cve-2025-64401-apache-openoffice-documents-can-contain-links-a-missing) (high, CVSS 7.5, published 12 Nov 2025) - [CVE-2025-64402: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an…](https://junglewise.ai/threats/cve-2025-64402-apache-openoffice-documents-can-contain-links-a-missing) (medium, CVSS 6.5, published 12 Nov 2025) - [CVE-2025-64407: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an…](https://junglewise.ai/threats/cve-2025-64407-apache-openoffice-documents-can-contain-links-a-missing) (medium, CVSS 5.3, published 12 Nov 2025) - [CVE-2025-64406: An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash…](https://junglewise.ai/threats/cve-2025-64406-an-out-of-bounds-write-vulnerability-in-apache-openoffice-could) (medium, CVSS 4.3, published 12 Nov 2025) - [CVE-2026-59265: Apache OpenOffice Java integration remote code execution](https://junglewise.ai/threats/cve-2026-59265-a-code-execution-issue-in-the-java-integration-in-apache) (info, published 2 Oct 2026) - [CVE-2026-59267: Apache OpenOffice heap buffer overflow in DXF parsing](https://junglewise.ai/threats/cve-2026-59267-a-crafted-dxf-document-causes-a-heap-buffer-overflow-in-draw-in) (info, published 4 Nov 2026) - [CVE-2026-90634: Apache OpenOffice out-of-bounds memory write in PDF import](https://junglewise.ai/threats/cve-2026-90634-an-uncontrolled-memory-access-in-the-pdf-import-code-of-apache) (info, published 4 Nov 2026) ## Vulnerabilities per week 12 vulnerabilities in the last four weeks, up 1100% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 12 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Apache technologies - [Apache Airflow](https://junglewise.ai/threats/technologies/airflow): 95 vulnerabilities - [Apache Camel](https://junglewise.ai/threats/technologies/camel): 87 vulnerabilities - [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat): 87 vulnerabilities - [Apache Thrift](https://junglewise.ai/threats/technologies/thrift): 77 vulnerabilities - [Apache Ofbiz](https://junglewise.ai/threats/technologies/ofbiz): 67 vulnerabilities - [Apache HTTP Server](https://junglewise.ai/threats/technologies/http-server): 62 vulnerabilities - [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server): 55 vulnerabilities - [Apache Brpc](https://junglewise.ai/threats/technologies/brpc): 36 vulnerabilities - [Apache Roller](https://junglewise.ai/threats/technologies/roller): 30 vulnerabilities - [Apache CloudStack](https://junglewise.ai/threats/technologies/cloudstack): 28 vulnerabilities - [Apache ActiveMQ](https://junglewise.ai/threats/technologies/activemq): 27 vulnerabilities - [Apache Apisix](https://junglewise.ai/threats/technologies/apisix): 27 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Apache OpenOffice vulnerabilities", https://junglewise.ai/threats/technologies/openoffice, 13 November 2026.