CVE-2021-40439: Apache Openoffice

Medium severity, CVSS 6.5. EPSS: 3.9% chance of exploitation in the next 30 days.

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.

Affected products

• Apache Openoffice: up to and including 4.1.10

Published 2021-10-07. Last modified 2026-06-17.