Manalyze CVE-2026-95958

Exploitation requires the attacker to supply a specially crafted PE file (with a malformed IMAGE_BASE_RELOCATION BlockSize field) that is then parsed locally by Manalyze 1.0.0 - for example a malware analyst manually running the tool or an automated triage/sandbox pipeline that ingests untrusted samples. Limiting factors: the attack is local only (no network vector), the victim must actively run Manalyze against the malicious file, and the impact is confined to crashing/disrupting the analysis tool (no code execution, no confidentiality or integrity loss). It is a real but low-consequence input-validation flaw.

This is a low-severity, locally-scoped robustness bug in a niche tool, not a real-world priority. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) with impact VC:N/VI:N/VA:L scores 4.8 and correctly reflects an availability-only outcome - an integer underflow of the relocation BlockSize field in Manalyze's PE parser that leads to a crash or out-of-bounds read, not code execution or data disclosure. There is no EPSS score, no CISA KEV listing, and no public exploit code reported (VulDB is the sole reporter). The 'local approach' means an attacker must get an analyst to run Manalyze against a crafted PE file; there is no remote/network exposure. Note a signal conflict: the input Tags include 'Information Disclosure', but the CVSS vector explicitly sets VC:N (no confidentiality impact) and only VA:L - the vulnerability is a denial-of-service/crash, so the Information Disclosure tag appears mislabeled. The patch commit adds explicit bounds checks (BlockSize < header_size and alignment validation), confirming the fix scope is defensive input validation. Overall: genuine bug, correctly fixed, but very low real-world urgency.

An attacker crafts a malicious PE binary with a relocation directory whose BlockSize field is smaller than the header size, then delivers it to a malware analyst or an automated pipeline that runs Manalyze on untrusted samples. When Manalyze parses the file, PE::_parse_relocations underflows when subtracting the header size from BlockSize, producing a huge value that drives an out-of-bounds read and crashes or disrupts the analysis process. No public exploit code has been published; the crash requires only that the victim analyze the attacker-supplied file locally.