CVE-2021-31506

Vulnerability

OpenText Brava! Desktop Build 16.6.4.55 contains an out-of-bounds read vulnerability in the parsing of PDF files. The flaw stems from a lack of proper validation of user-supplied data within the PDF parsing routine, leading to a read past the end of an allocated data structure. The affected product version is explicitly Build 16.6.4.55 [1].

Exploitation

An attacker must convince a target user to visit a malicious webpage or open a crafted PDF file. No authentication is required, but user interaction is necessary. The attacker does not need any special local privileges; the exploit is delivered remotely through social engineering [1].

Impact

Successful exploitation results in the disclosure of sensitive information (confidentiality impact) from the application's memory. While the direct consequence is an information leak, an attacker could potentially combine this flaw with other vulnerabilities to achieve arbitrary code execution in the context of the current process [1].

Mitigation

According to the available reference, no official patch or updated version has been mentioned as of the advisory publication date (June 7, 2021). Users should contact OpenText for the latest fixes, consider restricting access to untrusted PDF files, and apply any updates when they become available [1].