CVE-2026-90627

EUVD-2026-116876
The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
apacheopenoffice
𝑥
≤ 4.1.16
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://lists.apache.org/thread.html/s7y9fspdysqojnr1z7ppltxtc48b4ljf
http://www.openwall.com/lists/oss-security/2026/11/03/27