Submit #953395: JusticeRage Manalyze 0.9 Integer Underflow

Manalyze contains an integer underflow in PE::_parse_relocations() when parsing IMAGE_BASE_RELOCATION blocks.

The attacker-controlled reloc->BlockSize field is used in the calculation:

(reloc->BlockSize - header_size) / sizeof(uint16_t)

where header_size is 8 bytes.

The parser validates that BlockSize is not greater than the remaining relocation directory size, but does not reject values smaller than the 8-byte relocation block header before performing the subtraction.

When BlockSize is in the range 1-7, the unsigned subtraction underflows. For example, with BlockSize=4:

(4 - 8) = 0xFFFFFFFC

After division by sizeof(uint16_t), this produces a loop bound of 0x7FFFFFFE (2,147,483,646) iterations.

The loop subsequently performs fread() operations and pushes the resulting uint16_t values into a std::vector without terminating when EOF is reached, causing the vector to grow excessively and potentially exhaust available memory.

A crafted PE file with BlockSize=4 was used to reproduce the issue. A 50 MB PoC caused the parser to allocate approximately 50 MB for the relocation vector. Larger crafted files can cause correspondingly larger memory consumption and may result in an out-of-memory condition and denial of service.

This issue affects applications and services that process untrusted PE files using the Manalyze/manape parser, including automated malware analysis, scanning and CI/CD workflows.

Affected component: manape / PE parser

Affected function: PE::_parse_relocations()

Affected structure: IMAGE_BASE_RELOCATION

Trigger condition: IMAGE_BASE_RELOCATION.BlockSize < 8

Impact: Denial of Service through excessive memory consumption / resource exhaustion.

The issue was subsequently addressed upstream by adding validation that rejects relocation blocks smaller than the required header size and validates the relocation entry size.

Fix:
https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0

• Source: ⚠️ https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0
• User: akbarov (UID 100866)
• Submission: 08/30/2026 13:38 (23 days ago)
• Moderation: 09/22/2026 19:33 (23 days later)
• Status: Accepted
• VulDB entry: 408568 [JusticeRage Manalyze 1.0.0 PE Parser manape/pe.cpp PE::_parse_relocations BlockSize integer underflow]
• Points: 20