bnbdr

Compiled rules can execute malicious code regardless of PARANOID_EXEC

7

A malicious **compiled** rule file could escape YARA's virtual machine and execute arbitrary code despite the added checks introduced by `PARANOID_EXEC`. This is possible due to the design of the...

Incorrect VBA dir stream parsing of REFERENCENAME

1

When encountering a REFERENCENAME record of the VbaProject dir stream where `reference_reserved` is not `0x003E` the code doesn't continue parsing from that point because the implementation used a switch-case, so...