CVE-2021-38096
📋 TL;DR
CVE-2021-38096 is an out-of-bounds write vulnerability in Corel PDF Fusion's coreip.dll that allows arbitrary code execution when parsing malicious PDF files. Users of Corel PDF Fusion 2.6.2.0 are affected. Exploitation requires user interaction through opening a crafted PDF file.
💻 Affected Systems
- Corel PDF Fusion
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's machine in the context of the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration through spear-phishing campaigns targeting users who open malicious PDF attachments.
If Mitigated
No impact if users avoid opening untrusted PDF files or if the software is patched/disabled.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) but no authentication. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with Corel for updated version
Vendor Advisory: https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products
Restart Required: Yes
Instructions:
1. Check Corel website for security updates. 2. Download and install latest version of Corel PDF Fusion. 3. Restart system after installation.
🔧 Temporary Workarounds
Disable PDF Fusion file association
windowsPrevent PDF files from automatically opening with Corel PDF Fusion
Control Panel > Default Programs > Set Default Programs > Choose another program for PDF files
Use alternative PDF viewer
windowsConfigure system to use a different, patched PDF viewer as default
🧯 If You Can't Patch
- Restrict user permissions to limit impact of code execution
- Implement application whitelisting to prevent unauthorized executables
🔍 How to Verify
Check if Vulnerable:
Check installed version of Corel PDF Fusion in Control Panel > Programs and FeaturesCheck Version:
wmic product where name="Corel PDF Fusion" get versionVerify Fix Applied:
Verify version is updated beyond 2.6.2.0 and check Corel security advisories📡 Detection & Monitoring
Log Indicators:
- Application crashes of Corel PDF Fusion
- Unexpected process creation from PDF Fusion
Network Indicators:
- Outbound connections from PDF Fusion process to suspicious domains
SIEM Query:
Process creation where parent_process contains "PDFFusion" OR file_access where file_extension="pdf" AND process_name contains "PDFFusion"🔗 References
- https://www.fortiguard.com/zeroday/FG-VD-21-025
- https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products
- https://www.fortiguard.com/zeroday/FG-VD-21-025
- https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products
