CVE-2026-95958: JusticeRage Manalyze Integer Underflow

CVE-2026-95958 Overview

CVE-2026-95958 is an integer underflow vulnerability in JusticeRage Manalyze 1.0.0, an open-source static analyzer for Portable Executable (PE) files. The flaw resides in the PE::_parse_relocations function within manape/pe.cpp, part of the PE Parser component. An attacker who supplies a crafted PE file can manipulate the BlockSize argument to trigger the underflow. Exploitation requires local access and low privileges. The maintainer addressed the issue in commit c372b6bbca9d8c63812be50596fefa4a79c65fd0. The weakness is classified under [CWE-189] (Numeric Errors).

Critical Impact
A local attacker supplying a malicious PE file to Manalyze can trigger an integer underflow in the relocation parser, leading to potential availability impact on the analysis process.

Affected Products

JusticeRage Manalyze 1.0.0
Component: manape/pe.cpp PE Parser
Function: PE::_parse_relocations

Discovery Timeline

2026-09-23 - CVE CVE-2026-95958 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95958

Vulnerability Analysis

Manalyze parses PE relocation directories by iterating over relocation blocks. Each block carries a BlockSize field that determines how many entries follow. The PE::_parse_relocations function uses this field in arithmetic without validating that BlockSize is at least as large as the fixed header size subtracted from it. When BlockSize is smaller than the expected header size, the subtraction wraps around, producing a large unsigned value that misdirects subsequent loop bounds and read operations.

The secondary hardening in the same commit tightens IMAGE_DEBUG_MISC parsing, validating SizeofData, PointerToRawData, and Length against the file size before reading. Both changes reduce trust in attacker-controlled size fields inside PE structures.

Root Cause

The root cause is unchecked unsigned arithmetic on an attacker-controlled 32-bit size field. The parser assumed BlockSize would always exceed the fixed relocation header size, so subtraction produced a valid remaining-byte count. A crafted PE with BlockSize below that threshold underflows the counter and causes the parser to iterate over an incorrect memory range.

Attack Vector

Exploitation requires local access. An attacker crafts a PE file with a malformed relocation directory and induces a user or automated pipeline to analyze it with Manalyze. Because the tool is commonly used inside malware triage workflows, the affected code path is reached during routine analysis of untrusted samples.

cpp

// Source: https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0
// Patch in manape/pe.cpp - Harden relocation and debug MISC parsing

		else if (debug->Type == nt::DEBUG_TYPES.at("IMAGE_DEBUG_TYPE_MISC"))
		{
			image_debug_misc misc;
-			unsigned int misc_size = 2 * sizeof(std::uint32_t) + 4 * sizeof(std::uint8_t);
+			constexpr unsigned int misc_size = 2 * sizeof(std::uint32_t) + 4 * sizeof(std::uint8_t);
+			const std::uint64_t data_offset = debug->PointerToRawData;
+			if (debug->SizeofData < misc_size || data_offset > _file_size ||
+				debug->SizeofData > _file_size - data_offset)
+			{
+				PRINT_ERROR << "Invalid IMAGE_DEBUG_MISC bounds." << DEBUG_INFO_INSIDEPE << std::endl;
+				return false;
+			}
			memset(&misc, 1, misc_size);
			unsigned int saved_offset = ftell(_file_handle.get());
-			fseek(_file_handle.get(), debug->PointerToRawData, SEEK_SET);
-			if (misc_size != fread(&misc, 1, misc_size, _file_handle.get()))
+			if (fseek(_file_handle.get(), debug->PointerToRawData, SEEK_SET) ||
+				misc_size != fread(&misc, 1, misc_size, _file_handle.get()))
			{
				PRINT_ERROR << "Could not read DBG file information" << DEBUG_INFO_INSIDEPE << std::endl;
				return false;
			}
+			const unsigned int minimum_string_size = misc.Unicode == 1 ? 2 : 1;
+			if (misc.Length < misc_size + minimum_string_size || misc.Length > debug->SizeofData ||
+				(misc.Unicode == 1 && (misc.Length - misc_size) % 2 != 0))
+			{
+				PRINT_ERROR << "Invalid IMAGE_DEBUG_MISC Length." << DEBUG_INFO_INSIDEPE << std::endl;
+				return false;
+			}

Source: GitHub Manalyze Commit c372b6b

Detection Methods for CVE-2026-95958

Indicators of Compromise

Manalyze processes terminating abnormally or hanging when parsing specific PE samples.
PE files whose relocation directory declares a BlockSize smaller than the 8-byte relocation header.
Error output referencing IMAGE_DEBUG_MISC bounds after applying the patch, indicating a malformed input was rejected.

Detection Strategies

Fuzz Manalyze with malformed PE relocation and debug directories to reproduce parser failures.
Compare Manalyze binaries and source checkouts against commit c372b6bbca9d8c63812be50596fefa4a79c65fd0 to confirm patched builds are in use.
Instrument analysis pipelines to flag samples that cause the parser to crash or exit non-zero.

Monitoring Recommendations

Log process exit codes, stderr, and runtime for every Manalyze invocation in automated triage pipelines.
Alert on repeated parser failures from a single submitter or campaign, which may indicate targeted abuse.
Sandbox Manalyze execution and monitor for unexpected file or memory access during PE parsing.

How to Mitigate CVE-2026-95958

Immediate Actions Required

Rebuild Manalyze from the current master branch, ensuring commit c372b6bbca9d8c63812be50596fefa4a79c65fd0 is included.
Restrict Manalyze usage to isolated analysis environments where only authorized analysts submit samples.
Treat all input PE files as untrusted, including those from internal collection sources.

Patch Information

The upstream fix is commit c372b6bbca9d8c63812be50596fefa4a79c65fd0 in the JusticeRage Manalyze repository. Users of Manalyze 1.0.0 should update to a build containing this commit. Additional advisory context is available at VulDB CVE-2026-95958 and VulDB Vulnerability #408568.

Workarounds

Run Manalyze inside a container or virtual machine with no network access and minimal filesystem permissions.
Pre-filter submissions with a lightweight PE validator that rejects malformed relocation directories before invocation.
Limit local user accounts that can invoke Manalyze to trusted analysts only.

bash

# Configuration example: rebuild Manalyze from patched source
git clone https://github.com/JusticeRage/Manalyze.git
cd Manalyze
git checkout c372b6bbca9d8c63812be50596fefa4a79c65fd0
cmake .
make

# Run under a restricted user in an isolated environment
sudo -u manalyze-runner ./bin/manalyze /path/to/sample.exe