{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-59264","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","state":"PUBLISHED","assignerShortName":"apache","dateReserved":"2026-07-04T15:34:24.392Z","datePublished":"2026-11-04T11:02:42.505Z","dateUpdated":"2026-11-05T04:55:51.929Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-11-04T11:02:42.505Z"},"title":"Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer","problemTypes":[{"descriptions":[{"description":"CWE-427 Use of Uncontrolled Search Path","lang":"en","cweId":"CWE-427","type":"CWE"}]}],"source":{"discovery":"EXTERNAL"},"affected":[{"vendor":"Apache Software Foundation","product":"Apache OpenOffice","packageURL":"pkg:software-id/apache.org/openoffice","versions":[{"status":"affected","version":"0","lessThanOrEqual":"4.1.16","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"value":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.\nUsers are recommended to upgrade to version 4.1.17, which fixes this issue.","lang":"en","supportingMedia":[{"type":"text/html","base64":false,"value":"The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.<br>Users are recommended to upgrade to version 4.1.17, which fixes this issue."}]}],"references":[{"url":"https://lists.apache.org/thread.html/d4n33sjk8jgrr78jj5cq5r51fvxv6nnv","tags":["vendor-advisory"]}],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"moderate"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"credits":[{"lang":"en","value":"Kazuma Matsumoto, from GMO Cybersecurity by IERAE, Inc.","type":"reporter"}],"x_generator":{"engine":"Vulnogram 1.0.3"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/03/22"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-11-04T12:13:04.936Z"}},{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-11-04T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-59264"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-05T04:55:51.929Z"}}]}}