How to Fix CVE-2026-59267 in Apache Openoffice

The two-minute check

1. Open Apache Openoffice on the computer you use it on.
2. Click the Help menu, then choose the "About Apache Openoffice" option.
3. Look at the version number shown in that box.

The record covers version 4.1.16 and all earlier versions. The fix is in version 4.1.17. If your version number is 4.1.16 or lower, you're affected and should keep reading.

When you can stop reading

If you don't have Apache Openoffice installed on any computer, phone, or server in your business, none of this applies to you. You can close this tab. If you already see version 4.1.17 or later in the About box, the fix is already installed and you're done.

What the official record says

The Common Vulnerabilities and Exposures (CVE) record for this flaw carries a Common Vulnerability Scoring System (CVSS) score of 7.8, rated HIGH (NVD). The scoring detail says an attacker needs local access to the computer running the software, not access over a network. It also says no login credentials are needed, but someone has to open a crafted file for the attack to work. If successful, the record shows it can fully affect the confidentiality, integrity, and availability of data on that machine.

The Exploit Prediction Scoring System (EPSS) puts the probability of exploitation in the next 30 days at 0.21 percent, which sits at the 11.75 percentile compared to other flaws (FIRST.org). EPSS is a forecast of near-term exploitation activity, not a measure of how damaging the flaw is if it does get used. This flaw is not on the Known Exploited Vulnerabilities (KEV) catalog, and the record shows no confirmed exploitation so far.

This same update also fixes CVE-2026-59264, CVE-2026-90634, CVE-2026-90629, CVE-2026-90628, CVE-2026-90626, CVE-2026-90624, CVE-2026-59268, CVE-2026-90632, CVE-2026-90627, CVE-2026-59263, and CVE-2026-90631. You install one update to cover all of them; you don't need to track each one separately.

What that means for a business like yours

Someone would need to get a crafted document onto a computer and have an employee open it. That typically happens through an email attachment or a download from a website. Once opened, the file could crash the program or, in the worst case, let an attacker run their own code on that machine. There's a low chance of exploitation in the next 30 days, based on current data, but that can change once a working attack method circulates publicly.

If someone else manages your IT

Send your provider a short message. You can paste this in as-is.

• "Please confirm all computers running Apache Openoffice are updated to version 4.1.17."
• "This covers CVE-2026-59267 and the related fixes in the same release."
• "Let me know once it's done and how you verified it."

If you work with LayerLogix, this is exactly the kind of patching task covered under managed IT services, and we can confirm the fix across every machine for you.

If you manage it yourself

1. Open Apache Openoffice on each computer that has it installed.
2. Go to Help, then About Apache Openoffice, and note the version.
3. If the version is 4.1.16 or earlier, open the vendor's advisory for the update (Apache mailing list advisory).
4. Download and install version 4.1.17 following the instructions in that advisory.
5. Close and reopen the program after installation finishes.
6. Repeat on every machine that has the software installed.

There's no confirmed exploitation of this flaw right now, and it isn't on the Known Exploited Vulnerabilities catalog. That said, a patch is available, so a reasonable window to update is within the next couple of weeks rather than today. If that changes, for example if the flaw is added to the KEV catalog or active attacks are reported, the timeline shortens and you should treat it as urgent.

Don't just trust the installer's finish screen. Open Apache Openoffice again after the update completes. Go to Help, then About Apache Openoffice, and confirm the version now reads 4.1.17 or later. Do this on every machine you updated, not just the first one.

If you can't update immediately, a few steps reduce your exposure without fixing the underlying flaw.

• Avoid opening DXF, PDF, WMF, or Word-format files from people you don't know. This limits the chance someone triggers the flaw through a crafted document.
• Ask staff to save attachments and scan them before opening, rather than opening directly from email. This buys time but doesn't stop a well-crafted file that gets past scanning.
• Limit who has administrative rights on machines running this software. Our privileged access management guidance explains how to do this without slowing people down.
• Keep endpoint detection and response (EDR) monitoring active, if you have it, so unusual behavior after a file is opened gets flagged quickly. This helps you catch a problem but doesn't prevent one.

None of these steps replace the update. They just lower the odds something goes wrong while you schedule it.

Do I have to do anything if I only use this at home?

The same check applies. If the computer, phone, or server you run Apache Openoffice on shows version 4.1.16 or earlier, update it the same way described above.

Will installing the update break anything?

The record doesn't describe any compatibility issues with the update. Your documents, templates, and settings should carry over normally, but it's good practice to save open work before installing any update.

Do I need to do this on every single computer?

Yes, if more than one computer has Apache Openoffice installed. Each one needs its own check and its own update, since the fix lives in the installed program, not in a shared setting.

Is this actively being attacked right now?

No. The record shows no confirmed exploitation, and this flaw is not listed on the Known Exploited Vulnerabilities catalog. The forecast for exploitation in the next 30 days is low, but a patch being available is still a good reason to update.

What if I'm not sure which computers run this software?

That's a common problem once a business has more than a handful of machines. A quick inventory, done as part of a free IT assessment, will tell you exactly what's installed and where. If you'd rather have someone handle the update directly, contact LayerLogix and we'll take it from there with business-hours support and after-hours emergency response if something comes up. LayerLogix brings 20+ years of experience and 100% U.S.-based support to IT and cybersecurity work like this.