Vulnerabilities
OpenOffice Versions <4.1.17 Vulnerable to Remote Code Execution (CVE‑2026‑59265, CVE‑2026‑63277)
Multiple CVEs have been identified in OpenOffice versions older than 4.1.17 that enable remote code execution. The flaws allow an attacker to trigger arbitrary code on a target system via crafted documents. Defenders must apply the vendor’s patches immediately or upgrade to a supported release.
What happened
On 3 October 2026, the OpenOffice security team disclosed two critical vulnerabilities, CVE‑2026‑59265 and CVE‑2026‑63277, that permit remote code execution through maliciously crafted documents. The flaws reside in the document parsing engine and can be triggered without user interaction.
Affected systems
All OpenOffice installations with a version number lower than 4.1.17 are impacted. This includes the community edition and all derivatives that have not applied the latest security updates.
Impact
Exploitation results in full code‑execution privileges on the host machine, enabling attackers to install malware, exfiltrate data, or pivot to other systems within the network. The vulnerability can be leveraged by remote actors, making it a high‑severity risk for exposed or network‑connected machines.
Mitigation
- Upgrade to OpenOffice 4.1.17 or later.
- Apply the vendor‑supplied patches for CVE‑2026‑59265 and CVE‑2026‑63277 as soon as they are available.
- Block inbound traffic to the OpenOffice document processing service if the application is not required.
- Implement application whitelisting to prevent execution of untrusted documents.
Reference: OpenOffice CVE‑2026‑59265, CVE‑2026‑63277
Related vulnerabilities
Kemp LoadMaster Uninitialized Memory RCE - CVE-2026-8037
Progress Software’s Kemp LoadMaster is vulnerable to a remote code execution flaw in the escape_quotes function. The issue requires authentication and allows attackers to run code as root. Apply the vendor patch immediately and verify configuration hardening.
Read briefing
Microsoft Office Word CVE‑2026‑108437 RCE – Omitted from October 2026 Update
A remote code execution flaw in Microsoft Office Word (CVE‑2026‑108437) was fixed in the October 2026 security update, but the CVE was omitted from the public update list. Systems with Word that have not applied the October 2026 patch remain vulnerable. Administrators should verify patch status and install the update if missing.
Read briefing
Microsoft Office Access Remote Code Execution Vulnerability (CVE-2026-102849)
A heap-based buffer overflow in Microsoft Office Access (CVE-2026-102849) permits remote code execution by an unauthenticated attacker. All versions of Office Access are vulnerable until Microsoft releases a patch. Defenders should apply the update immediately, restrict network access to Office files, and monitor for exploitation attempts.
Read briefing
CVE-2026-108449: Microsoft Word RCE - Update Reminder
A remote code execution vulnerability in Microsoft Word (CVE-2026-108449) was initially addressed in October 2026 updates but was not formally documented in the security bulletin. Defenders should confirm October 2026 updates are applied to mitigate potential risk.
Read briefing