{"id":"CVE-2026-94090","summary":"JusticeRage Manalyze PE Parser pe.cpp _parse_debug integer underflow","details":"A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attack may be performed from remote. The patch is identified as 3e299685759f4f767088871de58c5d07f98ee382. A patch should be applied to remediate this issue.","modified":"2026-09-23T08:13:03.918987Z","published":"2026-09-20T22:00:12.644Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94090.json","cna_assigner":"VulDB","cwe_ids":["CWE-189","CWE-191"]},"references":[{"type":"WEB","url":"https://github.com/JusticeRage/Manalyze/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94090.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94090"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-94090"},{"type":"ADVISORY","url":"https://vuldb.com/submit/952519"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/408019"},{"type":"REPORT","url":"https://vuldb.com/vuln/408019/cti"},{"type":"FIX","url":"https://github.com/JusticeRage/Manalyze/commit/3e299685759f4f767088871de58c5d07f98ee382"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/justicerage/manalyze","events":[{"introduced":"7db76b061f89d77a526a792b35fcaecbad6bd7b7"},{"fixed":"3e299685759f4f767088871de58c5d07f98ee382"}],"database_specific":{"extracted_events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["1.0.0"],"database_specific":{"vanir_signatures_modified":"2026-09-23T08:13:03Z","vanir_signatures":[{"source":"https://github.com/justicerage/manalyze/commit/3e299685759f4f767088871de58c5d07f98ee382","target":{"function":"PE::_parse_debug","file":"manape/pe.cpp"},"deprecated":false,"digest":{"function_hash":"5416274527977272143534672506842864010","length":3989},"id":"CVE-2026-94090-077ada0d","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"152155742127046787982332939787033546603","length":841},"id":"CVE-2026-94090-1a20ebf7","signature_type":"Function","signature_version":"v1","source":"https://github.com/justicerage/manalyze/commit/3e299685759f4f767088871de58c5d07f98ee382","target":{"file":"test/pe.cpp","function":"make_debug_misc_pe"},"deprecated":false},{"target":{"file":"manape/pe.cpp"},"deprecated":false,"digest":{"line_hashes":["296109635517368590975695241811031512432","289135147858988760059674798538505789993","151143746873263204857306768589385505628","225710668447495397004255645390886588415","183325986263730029783145769233746546977","90582173553932575314405387802799452792","154257028370002510225263094581760415859","36172709890068655318798020204630538121","149889943652398752677489686183609684834","71526998423515312271542953915540357996","202318155549625008332030448881989882841","115439205321784745423808242879611741783","238494927523593442572704550793765130685","311989122385437283455065320014047237210","209965618180263821375013508179511324170","219265284750642822530512900507962012832","71929805483408745842925710765958607118","311147429252257852056979002929783686978","134977296412440903841155418426510596574","100615467961044819569849825942818938597","304713639177089646045678716564696380676","80040833729223203225869634493043603016","261233389944315929320483037924113636044","219413605428951603508052449386829189487","331270065945742785545994811652802141438","158051901366709820373382731455739888409","144946405742723332067247332157489693619","187588520966918252269590574675540444975","284760235592764497543482084667839890173","75566457279424238026719827398431048439"],"threshold":0.9},"id":"CVE-2026-94090-8ac7c42a","signature_type":"Line","signature_version":"v1","source":"https://github.com/justicerage/manalyze/commit/3e299685759f4f767088871de58c5d07f98ee382"},{"id":"CVE-2026-94090-d68d224f","signature_type":"Line","signature_version":"v1","source":"https://github.com/justicerage/manalyze/commit/3e299685759f4f767088871de58c5d07f98ee382","target":{"file":"test/pe.cpp"},"deprecated":false,"digest":{"line_hashes":["3514081005036912494133376946405813515","59073655091554525233957606979009719081","47138810603226528402459798571453765669","281136725216757451827478944628396869295","301566888024287365176169974996993202314","43452211572739086886185567402293339542","320768462486424700500029874543887639465","137486623369113021894009319195237742825","261380486450379977682327813992664754987","41007291069801110556411027421471550354","17701060656292203656200344004165128180"],"threshold":0.9}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94090.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}]}