Apache OpenOffice is vulnerable to an unauthorized file access flaw that allows remote attackers to silently load external resources via maliciously crafted documents.

This is a missing authorization vulnerability (CWE-862) triggered when a user opens a document containing background fill or bullet images linked to external files. The application fails to prompt for permission, allowing unauthenticated attackers to access and potentially exfiltrate local or network file contents.

The ability to silently load external file contents poses a significant risk to data confidentiality. An attacker could leverage this to exfiltrate sensitive local documents or probe internal network resources that the OpenOffice process can reach. Given the CVSS score of 7.5, this high-severity vulnerability represents a substantial threat to organizational data security, particularly in environments where sensitive documents are frequently processed.

Immediate Action: Upgrade all instances of Apache OpenOffice to version 4.1.16 or later, which contains the necessary authorization checks to prevent unauthorized file loading.

Proactive Monitoring: Review security logs for suspicious file system access patterns or unexpected network connection attempts originating from OpenOffice processes.

Compensating Controls: If immediate patching is not feasible, restrict the ability of the OpenOffice application to access external network locations or unauthorized local directories using host-based firewalls or application sandboxing.

Public Exploit Available: Unknown.

Organizations should prioritize the deployment of Apache OpenOffice version 4.1.16 across all endpoints. Because this vulnerability facilitates unauthorized access to files without user interaction, it represents an elevated risk for social engineering campaigns. Prompt application of the vendor update is the only effective way to neutralize the underlying authorization flaw.