The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8 as used by OpenOffice.org (OOo) before 3.4 allows remote attackers to execute arbitrary code via a crafted Wordperfect .WPD document that causes a negative array index to be used. NOTE: some sources report this issue as an integer overflow.