---
id: CVE-2026-59264
title: >-
  Apache OpenOffice: Uncontrolled search path element vulnerability in Windows
  installer
summary: >-
  The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an
  already manipulated system to run external code with elevated access.

  Users are recommended to upgrade to version 4.1.17, which fixes this issue.
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-427
vendor: Apache Software Foundation
product: Apache OpenOffice
affected:
  - apache_openoffice <= 4.1.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-04T00:00:00+00:00'
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T04:55:51.929Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-59264'
references:
  - url: 'https://lists.apache.org/thread.html/d4n33sjk8jgrr78jj5cq5r51fvxv6nnv'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.734Z'
---

## Overview

The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.

## Affected

- `apache_openoffice <= 4.1.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.