CVE-2026-94090: JusticeRage Manalyze PE Parser pe.cpp _parse_debug integer underflow
A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::parsedebug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attack may be performed from remote. The patch is identified as 3e299685759f4f767088871de58c5d07f98ee382. A patch should be applied to remediate this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JusticeRage Manalyze PE Parser (PE Parser)to a version that resolves this vulnerability.Fixed in 1.0.0Patch 3e299685759f4f767088871de58c5d07f98ee382
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using JusticeRage Manalyze 1.0.0 to parse PE files are exposed. Exploitation is described as remote, so systems that process attacker-supplied or untrusted PE files are the most relevant exposure point.
What does an attacker need to exploit the flaw?
The attacker needs to manipulate the misc.Length argument processed by the PE::_parse_debug function. No privileges are required, but user interaction is required according to the supplied severity vector.
Is a fix available?
Yes. The identified patch is commit 3e299685759f4f767088871de58c5d07f98ee382, and applying it is the stated remediation.