CVE-2021-42613

What it actually does

Double free in cleanup_index function in index.c causes memory corruption when processing a crafted input document.

Why it matters to the business

Attackers can crash the document processor or achieve arbitrary code execution on affected systems; the issue has been public for over four years with public exploit code available, increasing long-term risk for organizations still using the affected software.

How an attack unfolds

An attacker crafts a malicious text document that triggers the double-free condition in the index cleanup routine; when a victim opens the document with the vulnerable processor, memory corruption occurs that can be leveraged for denial of service or code execution.

How to fix it

Upgrade to a patched version of Halibut once released by the project maintainers; Fedora users should apply any available updates from the distribution. Until fixed builds are available, avoid processing untrusted documents with Halibut 1.2.

How to confirm the fix worked

Confirm the installed Halibut binary version is newer than 1.2 and test that the crafted document no longer triggers a crash or corruption during index cleanup.

Typical attack path

1. Attacker creates a specially crafted input document targeting the index processing code path
2. Victim opens the document locally using the vulnerable Halibut binary
3. The double free is triggered during cleanup_index execution
4. Memory corruption leads to crash or attacker-controlled code execution

How to detect it

Review process execution logs and file access records for Halibut invocations on untrusted documents; look for segmentation faults or abnormal memory error patterns during index processing.

What your security team should do

• Inventory all systems running Halibut and remove or isolate instances still at version 1.2
• Block untrusted document processing workflows until updates are applied
• Monitor for any new fixed versions from the Halibut project and Fedora repositories