Submeter #952519: JusticeRage Manalyze 0.9 Out-of-Bounds Read

Manalyze contains an integer underflow in `PE::_parse_debug()` when parsing `IMAGE_DEBUG_TYPE_MISC` debug entries.

The `misc.Length` field is read from the attacker-controlled PE file and is used in the unsigned subtraction:

`misc.Length - misc_size`

where `misc_size` is 12 bytes.

When `misc.Length` is smaller than `misc_size`, the subtraction wraps around to a very large unsigned value. This value is subsequently passed as the maximum read size to the string parsing routine, allowing the parser to read beyond the declared `IMAGE_DEBUG_MISC` structure until a null byte or EOF is encountered.

A crafted PE file with `misc.Length=0` was used to reproduce the issue. In the 66,048-byte PoC, the parser read 65,496 bytes starting immediately after the 12-byte `IMAGE_DEBUG_MISC` header and incorporated the attacker-controlled data into the `Debug artifacts` output.

This behavior can expose file data located beyond the declared `IMAGE_DEBUG_MISC` structure and can cause excessive memory consumption when processing crafted PE files containing large amounts of non-null data.

Affected component: `manape / PE parser`

Affected function: `PE::_parse_debug()`

Affected structure: `IMAGE_DEBUG_MISC`

Trigger condition: `IMAGE_DEBUG_MISC.Length < IMAGE_DEBUG_MISC` header size

The issue was subsequently addressed upstream by adding bounds validation for `IMAGE_DEBUG_MISC.Length` and restricting the string parser to the declared debug data size.

Fix:
https://github.com/JusticeRage/Manalyze/commit/3e299685759f4f767088871de58c5d07f98ee382

• Fonte: ⚠️ https://github.com/JusticeRage/Manalyze/commit/3e299685759f4f767088871de58c5d07f98ee382
• Utilizador: akbarov (UID 100866)
• Submissão: 28/08/2026 23h09 (há 23 dias)
• Moderação: 20/09/2026 10h07 (22 days later)
• Estado: Aceite
• Entrada VulDB: 408019 [JusticeRage Manalyze 1.0.0 PE Parser manape/pe.cpp PE::_parse_debug misc.Length Excesso de tampão]
• Pontos: 20