CVE-2021-31483

Vulnerability

The vulnerability (CVE-2021-31483) resides in the DWF file parsing component of OpenText Brava! Desktop version 16.6.3.84. The code fails to properly validate the length of user-supplied data before copying it into a fixed-length heap-based buffer. This heap-based buffer overflow can be triggered when a user opens a malicious DWF file or visits a page that causes the file to be loaded. No special configuration is required; the vulnerable code path is reachable when any DWF file is parsed.

Exploitation

An attacker must convince a user to open a malicious DWF file or navigate to a web page that delivers such a file. No authentication or prior access is needed; the attack relies on user interaction. The parsing logic processes the crafted data and overflows the heap buffer, corrupting memory in a way that can be leveraged for code execution.

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current process. Since the application runs with the user's privileges, the attacker gains the same level of access, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected system.

Mitigation

As of the publication date (2021-06-15), no patch had been released by OpenText. The vulnerability is listed in the ZDI advisory [1] but without a vendor patch timeline. Users should exercise caution when opening DWF files from untrusted sources. No workaround has been officially documented. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of writing.