CVE-2021-38103
📋 TL;DR
CVE-2021-38103 is an out-of-bounds write vulnerability in Corel Presentations 2020's IBJPG2.FLT filter. When a user opens a malicious PPT file, an attacker can execute arbitrary code with the victim's privileges. This affects users of Corel Presentations 2020 who open untrusted presentation files.
💻 Affected Systems
- Corel Presentations 2020
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malware installation, credential theft, or lateral movement within the network using the victim's privileges.
If Mitigated
Limited impact if user opens file in sandboxed environment or with restricted privileges.
🎯 Exploit Status
Exploitation requires user to open malicious file but technical complexity appears low based on vulnerability type.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest version of Corel Presentations 2020
Vendor Advisory: https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products
Restart Required: Yes
Instructions:
1. Open Corel Presentations 2020. 2. Go to Help > Check for Updates. 3. Follow prompts to install latest updates. 4. Restart application.
🔧 Temporary Workarounds
Disable IBJPG2.FLT filter
windowsRemove or disable the vulnerable filter component to prevent exploitation
Navigate to C:\Program Files\Corel\Corel Presentations 2020\Filters\ and rename or delete IBJPG2.FLT
Use alternative software
allOpen PPT files with alternative presentation software that isn't vulnerable
🧯 If You Can't Patch
- Implement application whitelisting to block execution of Corel Presentations
- Configure email/web gateways to block PPT attachments and educate users about file risks
🔍 How to Verify
Check if Vulnerable:
Check if Corel Presentations 2020 version 20.0.0.200 is installedCheck Version:
Open Corel Presentations 2020, go to Help > About Corel PresentationsVerify Fix Applied:
Verify Corel Presentations is updated to version later than 20.0.0.200📡 Detection & Monitoring
Log Indicators:
- Application crashes of Corel Presentations
- Unusual process creation from Corel Presentations
Network Indicators:
- Outbound connections from Corel Presentations to unknown IPs
SIEM Query:
Process:Name='Corel Presentations' AND (EventID=1000 OR ParentProcess='explorer.exe')🔗 References
- https://www.fortiguard.com/zeroday/FG-VD-21-031
- https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products
- https://www.fortiguard.com/zeroday/FG-VD-21-031
- https://www.fortinet.com/blog/threat-research/fortinet-security-researcher-discovers-multiple-vulnerabilities-across-multiple-corel-products
