As with anything to do with software, there have been many documented security vulnerabilities that relate to media files. While many of these exploits take advantage of attributes or variables of specific files types, such as metadata or comments associated with a file, my question is this:

Is it possible for a maliciously crafted media file (e.g. image or audio file) to contain its malicious payload not in the specific metadata of a file type but in the raw media data of the file itself, regardless of format?

For example, let's say that a malicious image file contains a specific sequence of pixels with specific RGB values that are parsed by an appropriate library and execute attacker code. Could this possibly constitute an attack vector?


... that are parsed by an appropriate library

Can one create such an appropriate library which will look for payload inside arbitrary images (not only metadata), extract and execute it? Yes, this is possible.

Will a "normal" library behave this way? No, it will not. It might have specific vulnerabilities which can be triggered by interpreting the image in the wrong way, i.e. making wrong assumptions about needed buffer sizes, value of parameters in image etc. This is only about metadata but about the encoded pixels themselves, especially if compression is involved - like in CVE-2020-1895.

But a universal vulnerability, which can be attacked regardless of image format, is very very unlikely to happen by accident. It could be part of a deliberately placed backdoor though. Or it could be a way to hide a more complex second stage payload which gets retrieved and executed by a small initial attack payload.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.