An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted encrypted PDF to trigger an out‑of‑bounds memory write. The resulting effect is a program crash or corruption of memory contents, which could degrade reliability or expose sensitive data if the corrupted area is read by the application.

The vulnerability affects Apache OpenOffice, distributed by the Apache Software Foundation. All releases of the 4.x series up to and including version 4.1.16 are impacted.

Exploitation requires the attacker to provide a malicious PDF to a user running the vulnerable OpenOffice instance. No public EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so evidence of real‑world exploitation is lacking. The CVSS score is not supplied, so the precise severity cannot be quantified, but the out‑of‑bounds write can cause program termination or memory corruption, which represents a serious risk if an attacker can gain write access to sensitive regions.