CVE-2009-3302 in OpenOffice
Summary
by MITRE
filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTSetBrc table property modifier in a Word document, related to a "boundary error flaw."
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/30/2026
The vulnerability identified as CVE-2009-3302 represents a critical boundary error flaw within the OpenOffice.org document processing engine, specifically in the filter/ww8/ww8par2.cxx component. This issue affects OpenOffice.org versions prior to 3.2 and demonstrates how improper input validation can lead to severe security consequences. The vulnerability manifests when processing Word documents containing specially crafted sprmTSetBrc table property modifiers, which are used to define table border properties within the document structure.
The technical flaw resides in the insufficient boundary checking mechanism within the ww8par2.cxx file, which handles the parsing of Word 8.0 document formats. When a maliciously constructed Word document is processed, the boundary error causes the application to access memory locations outside the intended buffer boundaries. This memory corruption leads to unpredictable behavior including application crashes or potentially allowing remote code execution. The sprmTSetBrc modifier specifically controls table border properties, and when manipulated with crafted values, it triggers the boundary error condition that propagates through the parsing pipeline.
This vulnerability presents significant operational impact for organizations relying on OpenOffice.org for document processing, as it can be exploited through simple document attachments without requiring any special privileges or user interaction beyond opening the malicious file. The potential for remote code execution makes this particularly dangerous in environments where users regularly open documents from untrusted sources. The denial of service aspect alone can disrupt business operations, while the remote execution capability could allow attackers to gain full system control.
The vulnerability maps to CWE-125 in the Common Weakness Enumeration, which specifically addresses out-of-bounds read conditions in software implementations. From an ATT&CK framework perspective, this represents a remote code execution technique that leverages a memory corruption vulnerability in a document processing application, falling under the T1203 and T1059 tactics. Organizations should implement immediate patch management procedures to upgrade to OpenOffice.org 3.2 or later versions where this vulnerability has been addressed through proper boundary checking mechanisms.
Mitigation strategies should include comprehensive document sanitization processes, restricting user access to document processing applications, and implementing network-based security controls such as email filtering and web application firewalls. Regular security assessments should verify that all document processing components are properly updated and that input validation mechanisms are functioning correctly. Additionally, user education regarding the risks of opening untrusted documents remains crucial in reducing the attack surface for this type of vulnerability.