CVE-2021-3630

What it actually does

Out-of-bounds write in DJVU::DjVuTXT::decode() triggered by a specially crafted DJVU file, resulting in memory corruption that manifests as a crash or segmentation fault.

Why it matters to the business

Processing of untrusted document files can cause application or service crashes, leading to denial of service and potential loss of availability for document-handling workflows.

How an attack unfolds

An attacker creates a malformed DJVU file that exercises the vulnerable decode path, then delivers the file to a target system where it is opened by software using an affected DjVuLibre version; the library performs the out-of-bounds write and terminates.

How to fix it

Upgrade DjVuLibre to version 3.5.28 or later on all affected systems; rebuild or reinstall dependent packages on Debian and Fedora after the library update.

How to confirm the fix worked

Confirm installed DjVuLibre version is at least 3.5.28; attempt to open a known-triggering test file in a controlled environment and verify no crash occurs.

Typical attack path

1. Craft a malicious DJVU file containing oversized or malformed text chunks
2. Deliver the file via email, download, or shared storage
3. Victim application opens or renders the file using the vulnerable library
4. Decode routine writes beyond allocated buffer bounds
5. Process crashes with segmentation fault

How to detect it

Review application and system logs for segmentation faults or crashes occurring during DJVU file processing; correlate crash reports with recent receipt of DJVU attachments or files.

What your security team should do

• Prioritize patching DjVuLibre and dependent packages on all systems that handle untrusted DJVU files
• Restrict opening of DJVU files from untrusted sources until updates are applied
• Monitor vendor advisories for downstream package updates in Debian and Fedora