Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
PeCoffLoaderImageAddress performs only an upper-bound check (Address >= ImageSize + TeStrippedOffset, line 917) before computing the returned pointer as ImageAddress + Address - TeStrippedOffset (line 922).
In the PE/COFF section loading loop at line 1404, the End bounds check computes Section->VirtualAddress + Section->Misc.VirtualSize - 1 where both operands are UINT32.
The PE/COFF relocation apply loop in PeCoffLoaderRelocateImage resolves each fixup target via PeCoffLoaderImageAddress, which validates only that the base byte offset satisfies Address < ImageSize + TeStrippedOffset.
// No embargoed advisories.