A crafted OpenOffice document can trick the GStreamer multimedia component into opening any local file. When the document is saved or exported, the content of that file is injected into the output, allowing an attacker who can create or modify a document to read sensitive files on the same machine. This constitutes a local file inclusion vulnerability, exposing the confidentiality of data stored on the host system. The weakness is exemplified by CWE‑552.

Apache OpenOffice versions up to and including 4.1.16 are affected. The security advisories target installations of Apache OpenOffice distributed by the Apache Software Foundation. No specific service or network component is required; the flaw is triggered by opening a maliciously crafted document from the local filesystem.

The flaw is local; no network-based exploitation is described. Because the vulnerability relies on a user‑supplied document, the attack surface is limited to environments where users can open files. EPSS data is unavailable, but the nature of the issue suggests a moderate to high risk for users that load files from untrusted sources. The flaw is not in the CISA KEV catalog, so there is no documented active exploitation at this time.