Bytecode - Covering the Android Vulnerabilities Master Key and Extra Field
Summary: Cisco Talos described ClamAV bytecode signatures built to detect the Master Key and Extra Field Android vulnerabilities, both of which allow arbitrary files to be added to signed APKs without breaking the digital signature. The signatures locate the last end_of_central_directory entry, compare file names for duplicates using an O(n2) loop because the bytecode engine has no malloc, and flag any extra_field_length above 0x7FFF as the Extra Field vulnerability.
Bottom line: The Extra Field technique lets an attacker replace nearly the entire contents of a signed application, and Talos notes one sample in the wild (MD5 C9F4C62521C04B8ADD796A1D5CEE08B0) was the first observed use of it. A signature that verifies an APK can still pass while the code inside it has been swapped.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026