Apache OpenOffice: Possible memory corruption during CSV import

published 2025-11-12 11mo ago modified 2026-10-18 22d ago also EUVD-2025-124971

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 46%
public exploits: 0; none known

An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other memory areas.

This issue affects Apache OpenOffice: through 4.1.15.

Users are recommended to upgrade to version 4.1.16, which fixes the issue.

Patch / fix

fixed in 1

apache openoffice 4.1.16

Is CVE-2025-64406 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 11mo ago (2025-11-12)

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Apache Software Foundation Apache OpenOffice

Classification

Weakness

CWE-787 Out-of-bounds Write

References

openoffice.org /security/cves/CVE-2025-64406.html
vendor-advisory
lists.apache.org /thread/py89gpogxfb2yo9c5vwv2h9x3m85pfmm
vendor-advisory, issue-tracking
openwall.com /lists/oss-security/2025/11/11/9
mailing-list, third-party-advisory

Sources

CVE List CVE-2025-64406
NVD CVE-2025-64406

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

json all entries feed