CVE-2017-20227: Jad Java Decompiler Buffer Overflow Flaw

CVE-2017-20227 Overview

CVE-2017-20227 is a stack-based buffer overflow in JAD Java Decompiler version 1.5.8e-1kali1 and prior. The vulnerability allows attackers to execute arbitrary code by supplying overly long input that exceeds buffer boundaries. Attackers craft malicious input passed to the jad command to overflow the stack and execute a return-oriented programming (ROP) chain that spawns a shell. The flaw maps to CWE-787 (Out-of-bounds Write) and affects the Varaneckas distribution of JAD packaged for Kali Linux.

Critical Impact
Successful exploitation grants arbitrary code execution in the context of the user invoking jad, enabling shell access and full compromise of confidentiality, integrity, and availability.

Affected Products

Varaneckas JAD Java Decompiler 1.5.8e-1kali1
All prior versions of JAD Java Decompiler
Kali Linux distributions shipping the affected jad package

Discovery Timeline

2026-03-28 - CVE-2017-20227 published to NVD
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2017-20227

Vulnerability Analysis

The JAD Java Decompiler is a closed-source command-line tool used to decompile Java .class files into readable Java source code. The vulnerability resides in input-handling routines that copy attacker-controlled data into fixed-size stack buffers without validating length. When a user invokes jad against a crafted filename or input string exceeding the buffer size, the excess bytes overwrite adjacent stack memory, including the saved return address.

Because the binary lacks modern compile-time mitigations, an attacker can overwrite the return pointer with the address of a gadget chain. The advisory references a working ROP chain that pivots execution into a shell, demonstrating reliable arbitrary code execution. The classification under CWE-787 reflects the out-of-bounds write into the stack region.

Root Cause

The root cause is the absence of bounds checking in string-handling operations within the jad binary. Unsafe C runtime functions copy untrusted input into stack-allocated buffers of fixed size. No length validation occurs before the copy, so any input longer than the destination buffer corrupts the stack frame, including the saved frame pointer and return address.

Attack Vector

An attacker delivers a crafted input — typically a long filename or argument — to the jad command. When a victim or automated pipeline processes the malicious input, the overflow triggers, the corrupted return address redirects execution to a ROP chain, and the chain ultimately calls execve to spawn /bin/sh. Exploitation requires no authentication and no user interaction beyond invoking the vulnerable tool against the attacker-supplied artifact.

No verified public proof-of-concept code is reproduced here. Technical details and a working exploit are documented in the Exploit-DB #42255 entry and the Vulncheck Advisory on JAD Buffer Overflow.

Detection Methods for CVE-2017-20227

Indicators of Compromise

Unexpected /bin/sh or shell child processes spawned by the jad binary on analyst or build systems.
Crash artifacts or core dumps from jad containing oversized argv entries or filenames.
Presence of jad package version 1.5.8e-1kali1 or earlier in installed package inventories.

Detection Strategies

Inventory endpoints and CI/CD runners for the jad binary and flag any version at or below 1.5.8e-1kali1.
Monitor process telemetry for jad invocations followed by execution of sh, bash, or other interactive shells as child processes.
Alert on jad command lines containing arguments or filenames exceeding several hundred bytes, which is atypical for legitimate use.

Monitoring Recommendations

Collect execve telemetry on Linux reverse-engineering workstations and forward it to a centralized log store for correlation.
Track package installation events for the jad package across managed Kali and Debian-derived hosts.
Audit malware analysis sandboxes that auto-process untrusted Java samples through jad, as these are the highest-risk exposure points.

How to Mitigate CVE-2017-20227

Immediate Actions Required

Remove or disable the vulnerable jad binary on systems where it is not actively required.
Restrict execution of jad to interactive analyst sessions and prevent automated pipelines from invoking it against untrusted input.
Run jad inside a non-privileged, network-isolated sandbox or container so a successful exploit cannot pivot to the host.

Patch Information

JAD is an unmaintained, closed-source utility and no vendor patch is available. The Varaneckas tool page is referenced in the Varaneckas Tool Overview. Operators should migrate to maintained Java decompilers such as CFR, Procyon, or Fernflower, which receive active security maintenance.

Workarounds

Replace jad with an actively maintained decompiler in analyst toolchains and automated workflows.
Execute legacy jad only within ephemeral containers with seccomp and no network egress to contain any successful exploitation.
Apply filesystem ACLs to prevent unprivileged users and service accounts from executing the jad binary.

bash

# Configuration example: remove jad and restrict execution if retained
sudo apt-get remove --purge jad

# If jad must remain available, restrict to a dedicated analyst group
sudo chown root:analysts /usr/bin/jad
sudo chmod 750 /usr/bin/jad

# Run jad inside an isolated container with no network access
docker run --rm --network=none -v "$PWD":/work -w /work \
  decompiler-sandbox jad SampleClass.class