CVE-2026-94090

MediumCVSS 6.3

Published: 20/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 21/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

24th percentile - higher than 24% of all known CVEs

Summary

A security flaw has been discovered in JusticeRage Manalyze 1.0.0 in the function PE::_parse_debug of file manape/pe.cpp (PE Parser component). Manipulation of the misc.Length argument results in an integer underflow. The attack may be performed remotely, and the patch is identified as 3e299685759f4f767088871de58c5d07f98ee382.

Risk Assessment

An integer underflow may lead to unpredictable parser behavior, memory errors, or potential code execution when analyzing malicious PE files. Organizations using Manalyze for malware analysis are exposed to attacks via crafted files.

Recommendation

Immediately apply patch 3e299685759f4f767088871de58c5d07f98ee382 or upgrade Manalyze to a version containing this fix.

Other vulnerabilities in Manalyze

CVE-2026-95958Low
A security flaw in JusticeRage Manalyze 1.0.0. The function PE::_parse_relocations in manape/pe.cpp of the PE Parser component is affected. Manipulating the BlockSize argument results in integer underflow. The attack requires local access. A patch named c372b6bbca9d8c63812be50596fefa4a79c65fd0 is recommended.

Original NVD description (English source)

A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attack may be performed from remote. The patch is identified as 3e299685759f4f767088871de58c5d07f98ee382. A patch should be applied to remediate this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS