{"id":"CVE-2026-59264","aliases":["EUVD-2026-116872","GHSA-78xp-gm58-q69q"],"status":"published","title":"Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer","description":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00218,"percentile":0.12371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-427"],"published":"2026-11-04T11:02:42Z","modified":"2026-11-05T16:01:06Z","products":[{"vendor":"apache","product":"openoffice"},{"vendor":"apache software foundation","product":"apache openoffice"}],"references":[{"url":"https://lists.apache.org/thread.html/d4n33sjk8jgrr78jj5cq5r51fvxv6nnv","tags":["vendor-advisory","Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/03/22","tags":["Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59264"},{"url":"https://github.com/advisories/GHSA-78xp-gm58-q69q"}],"sources":{"cve":[{"id":"CVE-2026-59264","title":"Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer","description":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","status":"published","published":"2026-11-04T11:02:42.505Z","modified":"2026-11-05T04:55:51.929Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-427"],"updated_at":"2026-11-05T06:56:15.67765Z"}],"euvd":[{"id":"EUVD-2026-116872","description":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","status":"published","published":"2026-11-04T11:02:42Z","modified":"2026-11-05T04:55:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T06:54:33.955364Z"}],"ghsa":[{"id":"GHSA-78xp-gm58-q69q","title":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated...","description":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","status":"published","published":"2026-11-04T12:31:31Z","modified":"2026-11-04T15:32:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-04T15:52:09.418756Z"}],"nvd":[{"id":"CVE-2026-59264","description":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","status":"published","published":"2026-11-04T11:17:16.577Z","modified":"2026-11-05T16:01:06.38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-427"],"updated_at":"2026-11-05T19:56:15.260054Z"}]}}