CVE-2026-94090: JusticeRage Manalyze 1.0.0 RCE Vulnerability

CVE-2026-94090 Overview

CVE-2026-94090 is an integer underflow vulnerability in JusticeRage Manalyze 1.0.0, an open-source static analyzer for Windows Portable Executable (PE) files. The flaw resides in the PE::_parse_debug function within manape/pe.cpp, part of the PE Parser component. Manipulating the misc.Length argument triggers an integer underflow during bounded MISC debug entry parsing. The issue is tracked under [CWE-189: Numeric Errors] and was disclosed via VulDB CVE-2026-94090. A fix is available in commit 3e299685759f4f767088871de58c5d07f98ee382.

Critical Impact
An attacker can supply a crafted PE file that causes an integer underflow in the debug directory parser, leading to memory corruption or process crash when the file is analyzed by Manalyze.

Affected Products

JusticeRage Manalyze version 1.0.0
Component: PE Parser (manape/pe.cpp)
Function: PE::_parse_debug

Discovery Timeline

2026-09-20 - CVE-2026-94090 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94090

Vulnerability Analysis

Manalyze parses PE debug directory entries to enumerate embedded debug data types, including CodeView, FPO, and MISC records. When processing MISC debug entries, PE::_parse_debug reads a Length field from the untrusted input and uses it to compute the size of subsequent buffer reads. Because the code does not validate that misc.Length is greater than the fixed header size before subtraction, a small attacker-controlled value causes an unsigned integer to wrap around to a very large value.

The resulting oversized read length is then passed to buffer allocation and stream-copy routines. Downstream code operates on the wrapped size, producing out-of-bounds reads, allocator failures, or heap corruption when the malformed PE is loaded. Because Manalyze is commonly used in automated malware triage pipelines, a single crafted sample can disrupt analyst workflows and sandbox infrastructure.

Root Cause

The root cause is missing bounds validation on the misc.Length field before arithmetic that subtracts the size of the MISC header. Unsigned subtraction on a value smaller than the header produces an integer underflow, which propagates as an incorrect element count into iterator-based reads.

Attack Vector

Exploitation requires an analyst or automated system to load an attacker-supplied PE file into Manalyze. The attack surface is remote in the sense that malicious binaries can be delivered through email, file-sharing platforms, or malware repositories. User interaction is required to invoke the analyzer against the crafted sample.

cpp

// Patch excerpt from manape/pe.cpp - harden bounded MISC debug parsing
 #include <io.h>
 #include <fcntl.h>
 #endif
+#include <iterator>
 #include <limits>

 namespace mana {

Source: GitHub Commit 3e29968. The patch introduces <iterator> to support bounded iterator-based reads and constrains parsing against std::numeric_limits, preventing the wrap-around condition.

Detection Methods for CVE-2026-94090

Indicators of Compromise

Manalyze processes that terminate abnormally or hang while parsing PE files with unusually small debug directory Length fields.
PE samples containing IMAGE_DEBUG_TYPE_MISC entries where the Length field is smaller than the MISC header structure size.
Unexpected crashes in automated malware triage or sandbox pipelines that invoke Manalyze on incoming binaries.

Detection Strategies

Statically scan submitted PE files for malformed debug directory entries prior to feeding them into Manalyze.
Instrument the analyzer with ASan or UBSan builds in test environments to surface integer underflow and out-of-bounds access during regression testing.
Correlate analyzer crash logs with the SHA-256 of the input sample to identify weaponized triage-disruption files.

Monitoring Recommendations

Log return codes and stderr output from Manalyze invocations in batch analysis jobs and alert on non-zero exits.
Track version strings of deployed Manalyze binaries across analyst workstations and sandbox nodes to confirm patch coverage.
Monitor the Manalyze GitHub repository for follow-up commits addressing related PE parser issues.

How to Mitigate CVE-2026-94090

Immediate Actions Required

Rebuild Manalyze from source at or after commit 3e299685759f4f767088871de58c5d07f98ee382 and redeploy to all analyst systems and sandbox workers.
Isolate PE parsing workloads inside containers or restricted service accounts to limit the blast radius of any residual parser bugs.
Restrict who can submit binaries to shared Manalyze instances and log every submission with source attribution.

Patch Information

The fix is committed to the upstream repository as commit 3e29968. Users running Manalyze 1.0.0 should pull the latest master branch, rebuild manape, and validate the resulting binaries against a corpus of known-good and known-malformed PE files before returning them to production.

Workarounds

Pre-filter incoming PE files with a lightweight validator that rejects samples where debug directory Length fields are smaller than the corresponding header size.
Run Manalyze inside an ephemeral container with strict CPU, memory, and filesystem limits so parser crashes cannot affect other jobs.
Disable debug directory parsing in Manalyze configurations where it is not required for the analysis workflow.

bash

# Rebuild Manalyze from the patched commit
git clone https://github.com/JusticeRage/Manalyze.git
cd Manalyze
git checkout 3e299685759f4f767088871de58c5d07f98ee382
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --parallel

# Optional: run under a resource-limited container
docker run --rm --cpus=1 --memory=512m \
  -v "$(pwd)/samples:/samples:ro" \
  manalyze:patched /samples/suspicious.exe