# CVE-2021-24083 — Windows Address Book `wab32.dll` Heap Buffer Overflow

---

## Summary

| **Product** | Microsoft Windows — `wab32.dll` (Windows Address Book) |
|---|---|
| **Vendor** | Microsoft Corporation |
| **Severity** | CVSS v3.1 **7.8 (High)** |
| **CVE Title** | Windows Address Book Remote Code Execution Vulnerability |
| **CWE** | CWE-122 (Heap-based Buffer Overflow) |
| **Affected Versions** | Windows 10/11 with Windows Address Book / Outlook Express |
| **Impact** | User-interaction required — opening malicious .wab/.vcf file → RCE |
| **Exploited ITW** | No |
| **Patch Date** | February 2021 Patch Tuesday |
| **Public analysis** | [Exodus Intelligence — Heap BOF in wab32.dll](https://blog.exodusintel.com/2021/08/05/analysis-of-a-heap-buffer-overflow-vulnerability-in-microsoft-windows-address-book/) |

---

## Root Cause

The Windows Address Book (`wab32.dll`) parses contact property arrays from
`.wab` (Windows Address Book) and `.vcf` (vCard) files. Two functions are
involved in the vulnerability:

- **`SecurityCheckPropArrayBuffer`** — validates the property array buffer
  before processing.
- **`HrGetPropArrayFromBuffer`** — reads properties from the buffer into a
  heap-allocated array.

The bug: `SecurityCheckPropArrayBuffer` computes the required buffer size based
on the property count and sizes, but **does not fully validate that the computed
size matches the actual buffer length**. When `HrGetPropArrayFromBuffer` later
copies properties into the heap array, it can read past the end of the input
buffer and write past the end of the output array — **heap buffer overflow**.

The overflow data is controlled by the attacker (embedded in the .wab/.vcf file)
and can corrupt heap metadata or adjacent objects.

### The patch (verified in ghidriff diff — wab32.dll 10.0.19041.388 → 10.0.19041.804)

- **Modified: `SecurityCheckPropArrayBuffer`** (73 % match, 415 → 264 bytes) — the
  validation loop was completely rewritten.
- **Added: `SecurityCheckMultiValueSimplePropTag`** (177 bytes) — new helper that
  validates multi-value property entries.
- The rewritten loop now calls `SecurityCheckMultiValueSimplePropTag` for each
  multi-value property. That helper checks `*(uint *)(prop + 4) <= remaining_size`
  and verifies `element_size × count` consistency before advancing the pointer.
- This closes the path where malformed `count` / `size` fields in a `.wab` or
  `.vcf` property array caused the heap buffer overflow.

---

## Reaching the bug — file-based attack

Requires user interaction (opening a malicious file):

```
Attacker-crafted .wab or .vcf file
    │
    ▼
User double-clicks file (or opens in Outlook/Windows Contacts)
    │
    ▼
wab32!HrGetPropArrayFromBuffer
    │   reads property count from file header
    ▼
wab32!SecurityCheckPropArrayBuffer
    │   incomplete validation — accepts malformed count/size
    ▼
wab32!HrGetPropArrayFromBuffer (continued)
    │
    ▼
memcpy(property_data)  ← reads/writes past buffer bounds → heap overflow
```

| Element | Value |
|---|---|
| Attack vector | Malicious `.wab` or `.vcf` file |
| Vulnerable functions | `wab32!SecurityCheckPropArrayBuffer`, `wab32!HrGetPropArrayFromBuffer` |
| Allocation | Heap (via `CoTaskMemAlloc` or similar COM allocator) |
| User interaction | Required — user must open the file |
| Privileges | Runs as the opening user (Medium IL typically) |

---

## Detection engineering

- **Email security**: Block `.wab` and `.vcf` attachments from untrusted sources.
- **Endpoint**: Alert on processes launching `wab.exe` or loading `wab32.dll`
  with a file from an untrusted zone (internet download, temp folder).
- **Crash forensics**: Heap corruption in `wab32!HrGetPropArrayFromBuffer` with
  a malformed `.wab`/`.vcf` file on the stack or in the crash dump.

## References

- [MSRC — CVE-2021-24083](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24083)
- [Exodus Intelligence — Heap BOF in wab32.dll](https://blog.exodusintel.com/2021/08/05/analysis-of-a-heap-buffer-overflow-vulnerability-in-microsoft-windows-address-book/)