# All Your (d)Base Are Belong To Us, Part 2: Code Execution in Microsoft Office (CVE-2021-38646)

Buffer overflow in Borland Database Engine's DBF parser (IDDBAS32) reachable via Microsoft Access xBase ISAM yields a write-what-where gadget and code execution.

- Payout: Research
- Severity: high
- Program: Microsoft
- Write-up by: Eugene Lim
- Disclosed: 2021-10-22
- CVE: CVE-2021-38646
- Write-up quality: 8/10
- Original: https://spaceraccoon.dev/all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-all-your-d-base-are-belong-to-us-part-2-code-execution-in-microsoft-office
- Tags: area:os domain:desktop impact:rce kind:research platform:research sev:high tech:windows technique:fuzzing technique:reverse-engineering technique:source-review vuln:dependency-confusion vuln:memory-corruption vuln:rce

**Target:** DBF file parsed by Borland Database Engine (IDDBAS32) via Access xBase ISAM (acexbe.dll)
**Root cause:** ACEXBE hard-codes a check for the legacy Borland Database Engine and delegates DBF parsing to unmaintained IDDBAS32, whose DBF record parsing overflows a zero-length buffer when fieldName is \x00, producing a controllable rep movs write-what-where.
**Steps:**
1. Install an app that drops Borland BDE (IDAPI32.DLL/IDDBAS32) so ACEXBE switches to BDE for DBF parsing
2. Craft DBF with fieldName set to `\x00` to trigger copy of remaining payload into zero-length buffer
3. Set languageDriver byte and a body offset to specific values to reach the crashing `rep movs dword ptr es:[edi],dword ptr [esi]`
4. Control ESI/EDI/ECX via payload bytes to write arbitrary bytes anywhere
5. Overwrite a fixed return pointer with a ROP chain: GetModuleHandleA > GetProcAddress > WinExec
6. Bypass Forced ASLR (Office 2013+) via memory-read leak or ActiveX scripting environment, then open DBF in Access to pop calc
**How found:** Coverage-guided WinAFL fuzzing of Access OLEDB/acecore via DBF corpus produced 'ghost crashes' that only reproduced when an unnamed office app was installed; stack trace showed IDAPI32 (Borland BDE), and IDA disassembly of ACEXBE revealed a hard-coded registry check for Software\Borland\Database Engine loading \IDAPI32.DLL. Switched to fuzzing IDAPI32 directly with a BDE harness.
**Exploitation:** Attacker delivers a malicious DBF opened by Microsoft Access; ACEXBE delegates to BDE, the overflow gives a write-what-where, and a ROP chain overwrites a return address to call WinExec. ASLR must be bypassed via a leak or ActiveX scripting since Office forces ASLR on non-ASLR modules.
**Escalation:** Chained write-what-where with ROP and an ASLR bypass (memory leak or ActiveX stripped-DLL load) to convert memory corruption into code execution in Office.
**Insight:** When fuzz crashes reproduce only on one machine, diff installed software: a third-party dependency silently swapped the parser backend. Check for hard-coded registry/path probes in disassembly that redirect to legacy unmaintained libraries, then fuzz those libraries directly.