Enviar #952519: JusticeRage Manalyze 0.9 Out-of-Bounds Read

Manalyze contains an integer underflow in `PE::_parse_debug()` when parsing `IMAGE_DEBUG_TYPE_MISC` debug entries.

The `misc.Length` field is read from the attacker-controlled PE file and is used in the unsigned subtraction:

`misc.Length - misc_size`

where `misc_size` is 12 bytes.

When `misc.Length` is smaller than `misc_size`, the subtraction wraps around to a very large unsigned value. This value is subsequently passed as the maximum read size to the string parsing routine, allowing the parser to read beyond the declared `IMAGE_DEBUG_MISC` structure until a null byte or EOF is encountered.

A crafted PE file with `misc.Length=0` was used to reproduce the issue. In the 66,048-byte PoC, the parser read 65,496 bytes starting immediately after the 12-byte `IMAGE_DEBUG_MISC` header and incorporated the attacker-controlled data into the `Debug artifacts` output.

This behavior can expose file data located beyond the declared `IMAGE_DEBUG_MISC` structure and can cause excessive memory consumption when processing crafted PE files containing large amounts of non-null data.

Affected component: `manape / PE parser`

Affected function: `PE::_parse_debug()`

Affected structure: `IMAGE_DEBUG_MISC`

Trigger condition: `IMAGE_DEBUG_MISC.Length < IMAGE_DEBUG_MISC` header size

The issue was subsequently addressed upstream by adding bounds validation for `IMAGE_DEBUG_MISC.Length` and restricting the string parser to the declared debug data size.

Fix:
https://github.com/JusticeRage/Manalyze/commit/3e299685759f4f767088871de58c5d07f98ee382

• Fuente: ⚠️ https://github.com/JusticeRage/Manalyze/commit/3e299685759f4f767088871de58c5d07f98ee382
• Usuario: akbarov (UID 100866)
• Sumisión: 2026-08-28 23:09 (hace 23 días)
• Moderación: 2026-09-20 10:07 (22 days later)
• Estado: Aceptado
• Entrada de VulDB: 408019 [JusticeRage Manalyze 1.0.0 PE Parser manape/pe.cpp PE::_parse_debug misc.Length desbordamiento de búfer]
• Puntos: 20