CVE-2021-31502

Vulnerability

This vulnerability is a use-after-free in the parsing of PDF files within OpenText Brava! Desktop Build 16.6.4.55. The issue arises because the program does not validate the existence of an object before performing operations on it, leading to memory corruption. User interaction is required, as the target must open a malicious PDF file or visit a malicious page that triggers the PDF parser. [1]

Exploitation

An attacker can exploit this vulnerability by crafting a specially designed PDF file and convincing a user to open it or by directing the user to a malicious web page that loads the PDF. No authentication or special network access is required beyond the user's environment. The flaw is reachable via the PDF parsing code path, and successful exploitation results in arbitrary code execution within the context of the current user process. [1]

Impact

Attackers can achieve arbitrary code execution with the privileges of the current user, leading to full compromise of confidentiality, integrity, and availability. The CVSS score is 7.8 (High) under the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. [1]

Mitigation

As of the ZDI advisory publication (June 2, 2021), no official patch was available. Users are advised to verify with OpenText for updates. Until a fix is applied, avoid opening untrusted PDF files to reduce risk. [1]