📄 Apache OpenOffice PDF Parsing Flaw Can Lead to Code Execution (CVE-2026-90624) A heap-based buffer overflow (CWE-122) in Apache OpenOffice's PDF import code can cause out-of-bounds memory writes when a user opens a crafted PDF, potentially letting an attacker run code. It was reported through the TrendAI Zero Day Initiative. 📊 Key facts ▪️ CVSS 6.3 (Medium) ▪️ Affected: Apache OpenOffice 4.1.16 and earlier ▪️ Fixed: 4.1.17, which adds bounds checking ▪️ No confirmed exploitation so far 📨 How it could be delivered ▪️ Phishing attachments ▪️ Malicious downloads from websites ▪️ Shared files or remote desktop sessions In every case, the victim has to open the PDF. 🛡️ What to do now 1️⃣ Upgrade every install to 4.1.17 2️⃣ Inventory systems still on 4.1.16 or older 3️⃣ Filter malformed PDFs at email and web gateways 4️⃣ Run OpenOffice with least privilege, with DEP and ASLR enabled 5️⃣ Alert on OpenOffice crashes and unusual behaviour 📖 Full analysis: https://badgersignal.com/articles/apache-openoffice-pdf-parsing-buffer-overflow-cve-2026-90624-enables-remote-code-execution #ApacheOpenOffice #Apache #CVE #BufferOverflow #Vulnerability #PatchManagement #CyberSecurity #BadgerSignal