diff --git a/poi/src/main/java/org/apache/poi/hpsf/ClassID.java b/poi/src/main/java/org/apache/poi/hpsf/ClassID.java
index 7e0ec5e2d8..7c99b1c4c3 100644
--- a/poi/src/main/java/org/apache/poi/hpsf/ClassID.java
+++ b/poi/src/main/java/org/apache/poi/hpsf/ClassID.java
@@ -109,11 +109,12 @@ public class ClassID implements Duplicatable, GenericRecord {
 
     /**
      * Gets the bytes making out the class ID. They are returned in correct order, i.e. big-endian.
+     * This no longer returns a reference to the internal byte array, but a copy of it.
      *
      * @return the bytes making out the class ID.
      */
     public byte[] getBytes() {
-        return bytes;
+        return bytes.clone();
     }
 
     /**