CVE-2021-31492

Vulnerability

This vulnerability (ZDI-21-632) is an out-of-bounds write in OpenText Brava! Desktop version 16.6.3.84 [1]. The flaw exists in the parser for DWF (Design Web Format) files. It is caused by a lack of proper validation of user-supplied data when processing DWF content, which can result in writing data past the end of an allocated buffer [1].

Exploitation

An attacker must convince the target to visit a malicious web page or open a crafted DWF file [1]. No prior authentication or network access is needed beyond standard user interaction. The attacker supplies a specially crafted DWF file that triggers the out-of-bounds write during the parsing process [1].

Impact

Successful exploitation yields arbitrary code execution within the context of the current user process [1]. This can lead to full compromise of confidentiality, integrity, and availability (CVSS 7.8) [1]. An attacker can achieve the same privileges as the logged-in user, which may be Administrator on Windows systems [1].

Mitigation

As of the ZDI advisory date (June 2, 2021), no official fix or update from OpenText has been disclosed [1]. Users should avoid opening untrusted DWF files in affected versions of Brava! Desktop until a patch is released. The product is not listed on CISA's Known Exploited Vulnerabilities catalog.