Dangerous Clipboard: Analysis of the MS15-072 Patch
Summary: Cisco Talos reverse-engineered Microsoft's July 2015 MS15-072 patch for the Windows graphics component, using BinDiff on gdi32.dll from Windows 7 SP1 x86 to compare it against the earlier MS15-035 update. Of thirteen functions BinDiff flagged, seven held significant security fixes, including integer overflow checks added around the size calculation passed to RtlAllocateHeap in GdiConvertBitmapV5, which Talos triggered to produce a write access violation and a heap chunk corrupted with 0x41 bytes.
Why it matters: Talos found no way through browser clipboardData, Flash, Java applets, or Mozilla XUL to force an image into the DIBV5 format the bug requires, so the practical reach of this elevation-of-privilege flaw depends on a delivery path that did not exist in the interfaces it examined.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026