Apache OpenOffice Fixes 7 Flaws: Memory Corruption and Unprompted Remote Content Loading

Apache OpenOffice has released a crucial security patch, version 4.1.16, to address seven vulnerabilities, including an important memory corruption flaw and six moderate issues tied to unauthorized remote content loading. Released on 12 November 2025, the update urges users of OpenOffice through version 4.1.15 to upgrade immediately to 4.1.16.

The most notable flaw, CVE-2025-64407, could allow a specially crafted document to silently steal system information, while a Missing Authorization weakness in the programme’s link handling could be exploited to load external links without prompting the user. The most severe rating is CVE-2025-64406, an out-of-bounds write flaw found during CSV import that could crash the program or corrupt memory.

Five additional moderate vulnerabilities share the Missing Authorization theme, allowing attackers to bypass prompts when loading remote content via various features including DDE in Calc, background fills, external data sources, OLE objects, and IFrame loading. According to The Apache OpenOffice Project, upgrading to 4.1.16 is advised to apply all fixes.