CVE-2021-31503

Vulnerability

This vulnerability affects OpenText Brava! Desktop Build 16.6.3.84 (package 16.6.3.134). The flaw exists in the parsing of IGS files, where a pointer is accessed without proper initialization. This can lead to arbitrary code execution. User interaction is required, as the target must open a malicious IGS file or visit a malicious page that triggers the parsing [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious IGS file and convincing a user to open it. No authentication or special network position is required; the attack is local in the sense that the user must execute the file. The uninitialized pointer is dereferenced during parsing, allowing the attacker to control execution flow [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process. This typically results in full compromise of the affected system, including potential data theft, installation of malware, or further lateral movement [1].

Mitigation

As of the publication date (2021-08-03), no official patch or fixed version has been disclosed in the available references. Users are advised to avoid opening untrusted IGS files and to monitor vendor updates for a security fix [1].