How Malformed RTF Defeats Security Engines

Summary: Cisco Talos reports that malware authors modified an RTF file to defeat security products by making the file type hard to classify, adding a PNG image header and a missing version so tools misidentify it, and by exploiting how Office ignores certain characters that third-party parsers treat as end-of-data and truncate the embedded OLE. The document exploits CVE-2016-7193, an array out-of-bounds in the RTF parser, using a heap spray built on the MSCOMCTL TabStrip control classid 1EFB6596-857C-11D1-B16A-00C0F0283628, a ROP chain, and a NOP sled jumping to shellcode that drops a Loki Bot stealer communicating with the command and control domain paneltestghelp.xyz.
What you should know: The exploit relies on a known vulnerability, but the malformed RTF defeats classification and extraction in security products and even in the open-source rtfobj.py parser, so a document can pass scanning and still deliver Loki Bot to the target.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2016-7193
Related: CVE-2016-7193: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026