CVE-2026-90632 in OpenOffice
Summary
by MITRE • 11/04/2026
Apache OpenOffice documents can include multimedia content (audio, video, etc.)
A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Apache OpenOffice versions through 4.1.16 represents a critical information disclosure flaw rooted in the improper handling of multimedia content within document files. Specifically, the defect resides in how the application interfaces with the GStreamer multimedia framework to process embedded audio and video assets. When an attacker crafts a malicious document containing specially constructed media elements, they can manipulate the internal processing logic to bypass standard security boundaries. This manipulation allows the application to inadvertently access arbitrary local file system resources that are typically restricted from user-level applications due to sandboxing or permission models designed to protect sensitive data.
The technical mechanism of this exploit relies on a path traversal or improper input validation error within the GStreamer integration layer. By embedding specific metadata or malformed media headers, an attacker can trick the multimedia parser into interpreting local file paths as valid resource locations for inclusion in the document structure. This flaw effectively neutralizes the isolation between the application runtime and the underlying operating system's file hierarchy. Consequently, when a victim opens such a crafted document, the vulnerability is triggered during the parsing phase, allowing the malicious code to read sensitive files from the user's local disk without explicit consent or awareness.
The operational impact of this vulnerability extends beyond simple data leakage. The core danger lies in the ability to exfiltrate these retrieved contents when the victim saves or exports the document, particularly into formats like PDF which are often shared externally. This creates a covert channel for data theft where sensitive information such as configuration files, personal documents, credentials stored in local text files, or proprietary source code can be extracted and embedded directly into the exported file. An attacker could then distribute this modified document to third parties who would unknowingly receive the stolen data, effectively turning Apache OpenOffice into a tool for remote data exfiltration without requiring additional malware installation on the victim's machine.
From a classification perspective, this vulnerability aligns with CWE-200, which covers Information Exposure, and more specifically CWE-798, regarding the use of hard-coded or default credentials if those are accessed via local files. It also maps to MITRE ATT&CK technique T1530, Data from Local System, as it involves collecting data stored on a victim's device through application-level exploitation rather than direct system compromise. The attack vector is classified as remote with user interaction, meaning the attacker must send the crafted document and rely on the victim opening or exporting it to trigger the exploit chain.
To mitigate this risk, immediate upgrading of Apache OpenOffice to version 4.1.17 or later is strongly recommended by the vendor, as these releases contain patches that correct the input validation logic within the GStreamer component. Organizations should enforce strict software update policies to ensure all endpoints are running patched versions. Additionally, users should be educated on the risks associated with opening documents from untrusted sources and advised to disable automatic saving or exporting features if possible until updates can be applied. Implementing application whitelisting or restricting file system access permissions for office applications can also provide an additional layer of defense against similar exploitation attempts in legacy systems that cannot be immediately upgraded.