{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aapacheopenoffice/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-59267"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA crafted DXF document causes a heap buffer overflow in the Draw component of Apache OpenOffice 4.1.16 and earlier. This vulnerability could cause an application crash or corruption of memory areas. Users are recommended to upgrade to version 4.1.17.\u003c/p\u003e\n","date_modified":"2026-11-04T18:50:28Z","date_published":"2026-11-04T18:50:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-openoffice-heap-overflow/","summary":"A heap buffer overflow in the Draw component of Apache OpenOffice 4.1.16 and earlier can be triggered by a crafted DXF document, potentially causing a crash or memory corruption.","title":"Apache OpenOffice: Heap buffer overflow in Draw component (CVE-2026-59267)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-openoffice-heap-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-90627"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenOffice (\u003c= 4.1.16)"],"_cs_severities":["high"],"_cs_tags":["lfi","vulnerability","office-software"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eA vulnerability exists in the flat file database driver within Apache OpenOffice versions through 4.1.16. This flaw allows a maliciously crafted document to read local files on the underlying system without user permission or interaction. Apache has released version 4.1.17 to remediate this issue.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized reading of arbitrary files from the local filesystem with the privileges of the user running the Apache OpenOffice process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Apache OpenOffice to version 4.1.17 or later immediately.\u003c/li\u003e\n\u003cli\u003eInventory systems running Apache OpenOffice version 4.1.16 or earlier.\u003c/li\u003e\n\u003cli\u003eApply the principle of least privilege to the user accounts running Office software to limit the scope of potential file access in the event of document-based exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T06:25:56Z","date_published":"2026-11-04T06:25:56Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-openoffice-lfi/","summary":"Apache OpenOffice versions through 4.1.16 contain a local file inclusion vulnerability in the flat file database driver that allows arbitrary file reads via crafted documents.","title":"Apache OpenOffice: Local file inclusion in flat file database driver (CVE-2026-90627)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-openoffice-lfi/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}