CVE-2021-32492

Name of the Vulnerable Software and Affected Versions djvulibre versions 3.5.28 and earlier

Description A flaw was found in the djvulibre library, specifically in the DJVU::DataPool::has data() function, which can lead to an out of bounds read when processing a crafted djvu file. This may cause an application crash and potentially allow a remote attacker to gain unauthorized access to protected information.

Recommendations For djvulibre versions 3.5.28 and earlier, consider avoiding the use of crafted djvu files until a patch is available. As a temporary workaround, restrict access to the DJVU::DataPool::has data() function to minimize the risk of exploitation.