CVE-2021-31479

Vulnerability

An uninitialized pointer vulnerability exists in OpenText Brava! Desktop version 16.6.3.84 during the parsing of PDF files. The flaw occurs when the software fails to properly initialize a pointer before accessing it while processing certain PDF elements [1]. This can be triggered when a user opens a malicious PDF file or visits a specially crafted web page that loads the vulnerable component.

Exploitation

To exploit this vulnerability, an attacker must convince the target to open a malicious PDF file or visit a malicious page. No special authentication or network position beyond delivering the file/page is required. The exploit leverages the uninitialized pointer to achieve code execution [1].

Impact

An attacker can achieve arbitrary code execution in the context of the current user process. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts (CVSS score 7.8) [1].

Mitigation

OpenText has addressed this vulnerability in a later version of Brava! Desktop. Users should update to the latest patched version available from OpenText. No workarounds are documented, and no KEV listing is present [1].