CVE-2021-31495

Vulnerability

This vulnerability affects OpenText Brava! Desktop version 16.6.3.84. The issue lies in the parsing of DXF files, where lack of proper validation of user-supplied data leads to a memory corruption condition [1]. An attacker can exploit this by crafting a malicious DXF file that triggers the corruption when parsed.

Exploitation

Exploitation requires user interaction: the target must visit a malicious page or open a malicious DXF file. No authentication or special privileges are needed; the attacker can deliver the file via social engineering or other means. Upon parsing the crafted DXF, the memory corruption allows the attacker to gain control.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process. This can lead to full compromise of confidentiality, integrity, and availability of the affected system.

Mitigation

No official patch or workaround has been disclosed in the available reference [1]. Users should exercise caution when opening DXF files from untrusted sources.