The mvUnoCursorTable in SwDoc is a publicly-accessible vector that is not protected by a lock in several places where it is used. While one thread is iterating through the vector, the cleanupUnoCursorTable() method in the same class may be called by another thread and call erase on the vector, thereby invalidating its iterators. This could lead to incorrect behavior.
Patch submitted: https://gerrit.libreoffice.org/c/core/+/113962
pretty much everything in sw is thread-unsafe by design - the entry points that can be called from multiple threads are the 100s of UNO service method implementations and they use the global SolarMutex to ensure thread safety. if sw code is called from the UI then VCL will have SolarMutex locked. a popular place where locks have historically been missing are the destructors of UNO service implementations, i forgot to what extent that is fixed now, see e.g. https://issues.apache.org/ooo/show_bug.cgi?id=105557 https://issues.apache.org/ooo/show_bug.cgi?id=107771 https://bugs.documentfoundation.org/show_bug.cgi?id=72695 https://bugs.documentfoundation.org/show_bug.cgi?id=65478