CVE-2026-59263Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.

1.9LowCVSS base score
0.16%Exploitation in 30 daysEPSS · top 95% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

Timeline

2026
4 Jul 2026
4 Jul 2026
ID reserved
By apache
4 Nov 20264 months later
4 Nov 2026· 4 months later
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-59263, by who scored it
Scored by	CVSS	Score	Vector
apacheCNA (assigner)	4.0	Low1.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/S:P/AU:N/R:A/U:Green
NVDNVD · Analyzed	4.0	Low1.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:A/V:X/RE:X/U:Green

EPSS (exploitation in 30 days): 0.16% · top 95% of all CVEs (13 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 1.9.

Affected products

Apache Software Foundation · Apache OpenOffice
- affected ≤ 4.1.16

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-59263](https://cveledger.app/badge/CVE-2026-59263.svg)](https://cveledger.app/cve/CVE-2026-59263)

Record last updated 4 Nov 2026, 15:18 UTC.