CVE-2023-21036

MEDIUM

Android - Improper Image Truncation in BitmapExport.java

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 6 public exploits for CVE-2023-21036. PoCs published by infobyte, qixils, lordofpipes.

AI-analyzed exploit summary This repository contains detection and sanitization tools for CVE-2023-21036, which involves incomplete data removal in cropped images (PNG/JPEG) leading to information leakage. The scripts identify and remove trailing data from improperly cropped images.

Description

In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidVersions: Android kernelAndroid ID: A-264261868References: N/A

Exploits (6)

nomisec WORKING POC 81 stars
by infobyte · poc
https://github.com/infobyte/CVE-2023-21036

This repository contains detection and sanitization tools for CVE-2023-21036, which involves incomplete data removal in cropped images (PNG/JPEG) leading to information leakage. The scripts identify and remove trailing data from improperly cropped images.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Windows Snipping Tool (and other image cropping tools)
No auth needed
Prerequisites: Access to cropped images affected by the vulnerability
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 21 stars
by qixils · poc
https://github.com/qixils/AntiCropalypse

This repository provides documentation and a Discord bot for mitigating the aCropalypse vulnerability (CVE-2023-21036 & CVE-2023-28303) by detecting and deleting vulnerable images. It includes self-hosting instructions and environment variable configurations.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Discord (PNG image handling)
Auth required
Prerequisites: Discord bot token · S3 bucket for archival (optional)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 2 stars
by lordofpipes · poc
https://github.com/lordofpipes/acropadetect

This repository contains a scanner tool for detecting Acropalypse (CVE-2023-21036), a vulnerability in image cropping tools that can leak sensitive data. The tool analyzes PNG, JPEG, WebP, and AVIF files for trailing data indicative of incomplete cropping.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Image cropping tools (e.g., Google Pixel's Markup tool)
No auth needed
Prerequisites: Access to potentially affected image files
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by iqbaalilmii · poc
https://github.com/iqbaalilmii/acropalypse-reconstructor

This repository contains a functional Python script that detects and reconstructs cropped images vulnerable to the Acropalypse vulnerability (CVE-2023-21036). It leverages the `acropalypse` library to recover trailing pixel data from vulnerable PNG files, supporting both Windows Snipping Tool and Google Pixel profiles.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Google Pixel Markup, Windows Snipping Tool
No auth needed
Prerequisites: Pillow library · vulnerable PNG file
devstral-2 · analyzed Jun 15, 2026 Full analysis →
nomisec SCANNER
by PolitoInc · poc
https://github.com/PolitoInc/XWFAcropalypse

This repository contains an X-Ways Forensics (XWF) extension designed to detect image files vulnerable to CVE-2023-21036 (Acropalypse). It marks affected files as 'notable' but does not include exploit code for recovering cropped data.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: X-Ways Forensics (XWF) with PNG files affected by CVE-2023-21036
No auth needed
Prerequisites: X-Ways Forensics (XWF) installation · PNG files processed by vulnerable software (Google Pixel Markup, Windows Snip & Sketch)
devstral-2 · analyzed Apr 17, 2026 Full analysis →
nomisec SCANNER
by notaSWE · poc
https://github.com/notaSWE/gocropalypse

This repository contains a scanner for detecting CVE-2023-21036, a vulnerability in image cropping tools that can leak sensitive data from cropped images. It includes both Go and Python implementations to scan directories for potentially vulnerable PNG and JPEG files.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Image cropping tools (e.g., Google Pixel's Markup tool)
No auth needed
Prerequisites: Access to potentially vulnerable cropped images
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 5.5
EPSS 0.0050
EPSS Percentile 38.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-703
Status published
Products (1)
google/android
Published Mar 24, 2023
Tracked Since Feb 18, 2026