Apache OpenOffice versions up to 4.1.16 contain an uncontrolled memory access in the PDF import component. A specially crafted PDF can cause the processor to write beyond allocated memory bounds, which may lead to the application crashing or corrupting memory. The weakness is identified as CWE‑787, indicating an out‑of‑bounds write vulnerability.

The vulnerable product is Apache OpenOffice provided by the Apache Software Foundation. All installations running version 4.1.16 or older are impacted; the fix is included in version 4.1.17.

The CVSS base score is not supplied, but the uncontrolled write represents a high severity risk. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation. Nonetheless, attackers could trigger a crash or manipulate memory content by delivering a malicious PDF to a user or automated import process, potentially leading to denial of service or, depending on the runtime environment, arbitrary code execution. The attack vector is inferred to be local or remote through a PDF import operation, as the flaw is triggered during file processing.