Vulnerability record/PUBLISHED/Published Nov 4, 2026 11:01:51 UTC

CVE-2026-59263

A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Base score1.9/ 10

SeverityLowCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityLow

Attack vectorLocalAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredNonePR

User interactionPassiveUI

Vulnerable system confidentialityLowVC

Vulnerable system integrityNoneVI

Vulnerable system availabilityNoneVA

Subsequent system confidentialityLowSC

Subsequent system integrityLowSI

Subsequent system availabilityNoneSA

Exploit maturityProof of conceptE

Safety impactSafety impact presentS

AutomatableNoAU

RecoveryAutomaticR

Provider urgencyGreenU

CVSS vector stringCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/S:P/AU:N/R:A/U:Green

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityapache

Last updatedNov 4, 2026 11:01:51 UTC

PublishedNov 4, 2026 11:01:51 UTC

ReservedJul 4, 2026 15:30:40 UTC

Credits

Yufan You from Tsinghua University