CVE-2026-59265: Apache OpenOffice Java RCE Vulnerability

CVE-2026-59265 Overview

CVE-2026-59265 is a code execution vulnerability in the Java integration component of Apache OpenOffice v4.1.16 and earlier. A crafted untrusted document can trigger execution of arbitrary code, including remote code, when opened by a user. The flaw is tracked under CWE-426: Untrusted Search Path and affects the way OpenOffice resolves class path URLs passed to the embedded Java Virtual Machine (JVM).

Apache OpenOffice plans to release a fix in version 4.1.17, which is currently in the release candidate phase. Users opening Writer, Calc, Impress, or Base documents from untrusted sources are at risk until the patched build is deployed.

Critical Impact
Opening a single malicious document can give an attacker full code execution in the context of the logged-in user, enabling malware delivery, lateral movement, and data theft.

Affected Products

Apache OpenOffice 4.1.16
All prior Apache OpenOffice 4.x releases
Installations with Java runtime integration enabled

Discovery Timeline

2026-10-02 - CVE-2026-59265 published to the National Vulnerability Database (NVD)
2026-10-02 - Initial Openwall OSS-Security advisory released
2026-10-08 - Follow-up Openwall OSS-Security advisory published
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-59265

Vulnerability Analysis

Apache OpenOffice embeds a Java runtime to support macros, extensions, Base database connectivity, and various scripting features. The jvmaccess module builds Java class paths from URLs that can originate from inside a document. Prior to the fix, the function ::jvmaccess::ClassPath::doTranslateToUrls accepted class path URL schemes without an allow-list check.

A crafted document can inject a class path URL that points to attacker-controlled code, including remote locations reachable by Java's URL loader. When the document is opened and the JVM resolves these URLs, the attacker's classes execute inside the OpenOffice process. User interaction is limited to opening the file, which makes the flaw well-suited to phishing campaigns delivering malicious .odt, .ods, or .odb payloads.

Root Cause

The root cause is an untrusted search path condition in the Java integration layer. The code in main/jvmaccess/source/classpath.cxx did not restrict acceptable URL schemes before passing them to the JVM. A secondary gap existed in main/sc/source/ui/docshell/dbdocimp.cxx, where database import flows did not consult a link authorizer before resolving document-supplied URLs.

Attack Vector

The attack is network-reachable through document delivery (email, web download, file share). The victim must open the document, after which code execution occurs without further prompts. The patch introduces an allow-list of local class path schemes: file:, jrt:, jmod:, and the matching jar: wrappers.

namespace css = ::com::sun::star;

#if defined SOLAR_JAVA
// URL schemes that resolve to the local file system or the running JVM image,
// optionally wrapped in a jar: URL.
//
// com.sun.star.comp.sdbc.Tools enforces the same allow-list on the Java side;
// keep the two in sync.
bool isLocalClassPathUrl(::rtl::OUString const & url)
{
    return url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("file:"))
        || url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jrt:"))
        || url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jmod:"))
        || url.matchIgnoreAsciiCaseAsciiL(
               RTL_CONSTASCII_STRINGPARAM("jar:file:"))
        || url.matchIgnoreAsciiCaseAsciiL(
               RTL_CONSTASCII_STRINGPARAM("jar:jrt:"))
        || url.matchIgnoreAsciiCaseAsciiL(
               RTL_CONSTASCII_STRINGPARAM("jar:jmod:"));
}
#endif

Source: Apache OpenOffice Commit 95923fd

Detection Methods for CVE-2026-59265

Indicators of Compromise

OpenOffice processes (soffice.bin, soffice.exe) spawning java or javaw child processes shortly after a document is opened.
Outbound network connections from the OpenOffice or JVM process to unknown hosts following document open events.
Documents referencing non-local class path URL schemes such as http:, https:, ftp:, or jar:http:.
Unexpected file writes under user profile paths originating from the OpenOffice process tree.

Detection Strategies

Hunt for parent-child process relationships where soffice* launches java, javaw, cmd.exe, powershell.exe, bash, or sh.
Inspect inbound email attachments and web downloads for OpenDocument files containing embedded class path references to remote URLs.
Alert on JVM instances loaded by OpenOffice making outbound connections to non-corporate destinations.

Monitoring Recommendations

Enable process-tree and command-line telemetry on all workstations with Apache OpenOffice installed.
Correlate document-open events with subsequent network and file-system activity in your EDR or SIEM.
Track installed OpenOffice versions through software inventory to identify unpatched hosts running 4.1.16 or earlier.

How to Mitigate CVE-2026-59265

Immediate Actions Required

Disable Java runtime integration in Apache OpenOffice via Tools → Options → OpenOffice → Advanced → Use a Java runtime environment.
Block or quarantine OpenDocument format attachments from untrusted senders at the mail gateway.
Instruct users not to open documents from unknown or unverified sources until 4.1.17 is deployed.
Inventory endpoints to identify every host running Apache OpenOffice 4.1.16 or earlier.

Patch Information

The fix is expected in Apache OpenOffice 4.1.17, currently in release candidate phase. Two commits address the issue: commit 95923fd adds the isLocalClassPathUrl allow-list in jvmaccess/source/classpath.cxx, and commit c699bed introduces an XLinkAuthorizer check in the Calc database import path. Upgrade to 4.1.17 as soon as the general availability build is published and track vendor communications via the Apache mailing list thread.

Workarounds

Turn off Java integration in the Preferences dialog, which the vendor confirms prevents the attack.
Avoid opening untrusted documents entirely until the patched build is installed.
Apply application allow-listing to prevent soffice* from spawning java, javaw, or shell interpreters.

bash

# Disable Java integration from the command line (Linux example)
# Edit the user registry to turn off Java use for the current profile.
sed -i 's|<prop oor:name="Enable" oor:op="fuse"><value>true</value>|<prop oor:name="Enable" oor:op="fuse"><value>false</value>|' \
  ~/.openoffice/4/user/registrymodifications.xcu

# Verify no OpenOffice process is currently loading a JVM
pgrep -a java | grep -i office