Use-After-Free: A content frame can be destroyed during object formatting, leaving a dangling pointer that is later dereferenced via pContent->IsTextFrame(), leading to memory corruption. The fix added a listener to detect frame destruction, indicating a missing lifetime-management guard.

Cryptographic Weakness: Nonce and salt generation used a weak random source (uniform_uint_distribution), making encryption parameters predictable and potentially weakening the Agile encryption scheme. The fix replaced it with a cryptographically secure generator.