R3n3r0/CVE-2026-0049

GitHubRepository PoCExploit

PoC files

15 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a full exploit kit for CVE-2026-0049, an integer overflow vulnerability in Android's DNG SDK. It includes multiple Python scripts to generate malicious DNG files that trigger the overflow, a C harness to execute the crash on-device via the Android ImageDecoder API, and pre-built sample DNG files. The primary purpose is to cause a denial-of-service crash (SIGABRT) by exploiting the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept for CVE-2026-0049, an integer overflow in Android's DNG decoder. All reviewed scripts and source code are consistent with generating or triggering the described denial-of-service vulnerability. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPythonCMarkdown
Target softwareAndroidAdobe DNG SDK (libdng_sdk.so)
Attack typesDenial of Service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains multiple Python scripts (make_poc_dng.py, inject_opcode.py, make_dng.py) whose primary function is to construct a malicious DNG file that triggers the CVE-2026-0049 vulnerability. It also includes a C harness (decode_poc.c) to execute the crash on a device. The README explicitly describes this as a 'PoC' and provides reproduction steps to cause a crash. This is code intended to exercise a vulnerability, which meets the definition of an exploit.

README.md:1README.md:45-67poc/make_poc_dng.py:1-5harness/decode_poc.c:1-4

Requirements

  • A target Android device with a vulnerable version of libdng_sdk.so (Android 14, 15, or 16) compiled with Integer Sanitizer.README.md:8-9
  • The malicious DNG file must be placed in a location scanned by the Android media scanner or opened by an app that decodes DNG images.README.md:25-26

Observed behavior

  • Generates a malicious DNG file containing an OpcodeList2 with a MapTable opcode where Plane and Planes fields are set to cause an unsigned integer overflow (0xFFFFFF00 + 0x00000200).poc/make_poc_dng.py:46-76poc/inject_opcode.py:14-20
  • When the malicious DNG is decoded by the Android system, the integer overflow triggers an abort in the Integer Sanitizer, causing a SIGABRT crash in the decoding process.README.md:6-9harness/decode_poc.c:1-4
  • Provides a native C harness (decode_poc.c) that uses the Android AImageDecoder API to trigger the crash on a device, demonstrating the exploit path.harness/decode_poc.c:1-46
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Trigger
Plane=0xFFFFFF00, Planes=0x00000200These values cause an unsigned integer overflow in dng_opcode_MapTable::ProcessArea, leading to a SIGABRT when compiled with integer sanitizers.poc/inject_opcode.py:23poc/make_dng.py:101poc/make_poc_dng.py:56
Exploit Mechanism
Injection of a malicious OpcodeList2 (TIFF tag 51009) containing a MapTable opcode into a DNG file.The PoC scripts construct or modify DNG files to include the crafted opcode, which is the documented method to trigger the vulnerability.poc/inject_opcode.py:4-10poc/make_poc_dng.py:4-27
Test Harness
Native Android harness using AImageDecoder to trigger the crash on-device.The harness is a straightforward C program that decodes a DNG file using the Android image decoder API, matching the documented crash path.harness/decode_poc.c:1-46
Review boundaries

What the analysis did not establish

  • Three binary DNG sample files (valid_poc.dng, base_benign.dng, poc_minimal.dng) were not analyzed; their content is only known from metadata and surrounding documentation.
  • Six text files (BLOG.md, BLOG.en.md, evidence/crash_backtrace.txt, evidence/device_analysis.md, poc/make_poc_dng.py, harness/dng_xmp_stub.cpp) were not included in the evidence packet, limiting full context.
  • The analysis is based solely on the provided source code and documentation; the exploit was not executed or verified.
  • Three binary DNG sample files (samples/base_benign.dng, samples/poc_minimal.dng, samples/valid_poc.dng) were not analyzed for embedded payloads beyond the documented opcode injection.
  • Six text files (BLOG.md, BLOG.en.md, evidence/crash_backtrace.txt, evidence/device_analysis.md, harness/dng_xmp_stub.cpp, and one other) were omitted from the packet and not reviewed.
  • The review is limited to static analysis of the provided source code; no dynamic execution or binary analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1