Deep dive in Lexmark Perceptive Document Filters Exploitation
Summary: Cisco Talos detailed a stack-based buffer overflow in Lexmark's Perceptive Document Filters, the parsing libraries used by MarkLogic and found in its Converters directory alongside the convert binary. The memcpy size argument is read directly from the file as a 32-bit integer via common::StreamReader::readInt32 inside common::read_MSOFBH, letting a crafted XLS overwrite the return address at offset 264 with 0x850 bytes of space for a ROP chain.
Key Takeaway: The convert binary has no ASLR and no RELRO, and the only obstacle to code execution was a missing syscall gadget, which Talos found in the 12MB libISYSreadershd.so - so a document fed to a metadata parser is enough to reach a writable fixed-address region and a full ROP chain.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026