Description

A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attack may be performed from remote. The patch is identified as 3e299685759f4f767088871de58c5d07f98ee382. A patch should be applied to remediate this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-20T22:16:30.703Z",
  "pubdate": "2026-09-20T22:16:30.703Z",
  "executiveSummary": "A critical integer underflow vulnerability has been identified within the PE Parser component of JusticeRage Manalyze version 1.0.0. The flaw resides in the PE::_parse_debug function located in manape/pe.cpp. This vulnerability arises from improper validation of the misc.Length argument during the parsing of PE (Portable Executable) debug directories. An unauthenticated remote attacker can exploit this weakness by providing a specially crafted malicious PE file to the application. Successful exploitation of this integer underflow can lead to undefined memory behavior, potentially resulting in application crashes, denial-of-service (DoS) conditions, or arbitrary code execution depending on how the subsequent memory operations are handled. Given that the parser processes potentially untrusted files, the risk is elevated for systems that automatically analyze binaries. Remediation requires applying the developer-provided patch (3e299685759f4f767088871de58c5d07f98ee382) to introduce rigorous bounds checking on the length fields processed by the debug parser.",
  "technicalDetails": "The vulnerability is located in the PE::_parse_debug function within manape/pe.cpp. The component is responsible for parsing the debug directory structures of Portable Executable (PE) files. During the processing of the DEBUG_DIRECTORY structure, the parser extracts the misc.Length field, which indicates the size of the debug data associated with the entry.\nThe integer underflow occurs when the provided misc.Length value is not properly sanitized or checked against the actual size of the input buffer before being utilized in pointer arithmetic or memory allocation routines. Specifically, if the misc.Length value is smaller than a required base offset or header size, the subtraction operation used to calculate remaining data or allocation size results in an integer underflow. In C++, when an unsigned integer is decremented below zero, it wraps around to a very large positive value (e.g., ULONG_MAX).\nAn attacker can exploit this by constructing a malicious PE file where the debug directory entry specifies a misc.Length value designed to trigger this underflow during calculation. When the application performs memory operations—such as copying data from the file into a buffer or advancing a pointer based on this corrupted calculation—the system may perform out-of-bounds memory access.\nThe attack flow proceeds as follows: First, the attacker delivers a malicious PE file to a system running JusticeRage Manalyze 1.0.0. Second, the PE Parser component initializes the processing of the file structure. Third, the PE::_parse_debug function is invoked to handle the debug directory entry. Fourth, the function reads the attacker-supplied misc.Length field. Fifth, the vulnerable arithmetic operation is executed, resulting in an integer underflow and a subsequent incorrect memory offset calculation. Finally, the application attempts to read from or write to memory at this incorrect offset, resulting in memory corruption.\nThis vulnerability is reachable via remote attack vectors, as it is triggered during the analysis of binary files which may be fetched over a network or uploaded by users. Exploitation does not require prior authentication, as the parser operates on the input data stream directly. The impact is significant, as it can lead to memory corruption, potential code execution, or service interruption, posing a substantial risk to integrity and availability of the analysis environment."
}