Vulnerability record/PUBLISHED/Published Nov 4, 2026 11:05:59 UTC

CVE-2026-59267

A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Base score5.8/ 10

SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorLocalAV

Attack complexityHighAC

Attack requirementsNoneAT

Privileges requiredNonePR

User interactionPassiveUI

Vulnerable system confidentialityHighVC

Vulnerable system integrityHighVI

Vulnerable system availabilityHighVA

Subsequent system confidentialityHighSC

Subsequent system integrityHighSI

Subsequent system availabilityHighSA

Exploit maturityUnprovenE

Safety impactSafety impact presentS

CVSS vector stringCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/S:P

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityapache

Last updatedNov 4, 2026 11:05:59 UTC

PublishedNov 4, 2026 11:05:59 UTC

ReservedJul 4, 2026 15:40:11 UTC

Credits

Trail of Bits, in collaboration with Anthropic