Other nomination

Facebook Messenger server random memory exposure through corrupted GIF

Dzmitry · Blogger · 6 March 2019

A malformed GIF declared a canvas but omitted image data, causing Facebook Messenger’s server-side renderer to fill the output with uninitialized memory. Repeated uploads produced different images containing fragments left by other server activity, demonstrating a remote information leak through image processing.

Record

Researcher

Dzmitry

Published by

Blogger

Date

6 March 2019

In the archive

• Nominated for the 2019 Top 10 Web Hacking Techniques

Tags

• info-leak
• file-upload
• memory-corruption
• bug-bounty
• case-study

This page is the archive's own catalogue record. The research is the work of Dzmitry, first published at the original source. Preserved copies are kept so the citation survives its host.