A crafted untrusted document exploits a flaw in Apache OpenOffice's Java integration, allowing an attacker to execute arbitrary local or remote code when the document is opened. This can result in complete system takeover for the user who opens the file, as the code runs with the same privileges as the user. The weakness corresponds to CWE-426, which concerns executing untrusted code from a document.

Apache Software Foundation's Apache OpenOffice, versions 4.1.16 and earlier, are affected. The issue is intended to be fixed in version 4.1.17, currently in release candidate status.

The vulnerability can be exploited when a user opens a malicious document; based on the description, the likely attack vector is local and requires user interaction to open the file, but this is inferred rather than explicitly stated. An EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA's KEV catalog, suggesting no known mass exploitation yet. Despite the lack of exploitation metrics, the potential for remote code execution indicates a high severity. Until the fixed release is available, the greatest risk is for users who open untrusted documents with Java integration enabled.