CVE-2021-32490

What it actually does

Out-of-bounds write in DJVU::filter_bv() triggered by a crafted DJVU file, resulting in memory corruption that can cause application crashes or arbitrary code execution.

Why it matters to the business

Systems that process untrusted DJVU files may experience application failures or full compromise, disrupting document workflows and requiring emergency incident response; the issue affects widely distributed packages but shows low current exploitation probability.

How an attack unfolds

An attacker crafts a malicious DJVU file that triggers the out-of-bounds write when processed by vulnerable djvulibre code; the file is delivered via email, web download, or shared storage, and execution occurs when a user or automated process opens it locally with an affected viewer or library.

How to fix it

Upgrade djvulibre to a version newer than 3.5.28 that contains the fix for the filter_bv out-of-bounds write; on Debian systems apply the latest available package updates; disable DJVU processing or use alternative libraries where upgrades are not feasible.

How to confirm the fix worked

Confirm djvulibre version is newer than 3.5.28 and test processing of known-good and known-bad sample files; review package changelogs for the filter_bv correction and run regression tests on document handling pipelines.

Typical attack path

1. Craft malicious DJVU file exploiting filter_bv bounds check failure
2. Deliver file to target via common channels such as email attachment or download link
3. Victim opens the file using vulnerable djvulibre-based application
4. Memory corruption occurs, potentially leading to crash or code execution

How to detect it

Search application and system logs for crashes or segmentation faults occurring immediately after DJVU file access; inspect process memory dumps or core files for evidence of corruption around filter_bv operations; correlate file-open events with subsequent abnormal behavior.

What your security team should do

• Prioritize patching djvulibre on all systems that handle untrusted DJVU content
• Block or sandbox DJVU file processing until updates are applied
• Monitor for new fixed package releases in Debian and upstream repositories
• Review and reduce reliance on the DJVU format in document workflows