← Advisories

Rakuten Viber (iOS) 29.4 Zero-Size Logical Screen GIF Remote 1-Tap Crash

Medium
Advisory ID
ZSL-2026-6039
Release Date
10 November 2026
Vendor
Viber Media S.a.r.l. - https://www.viber.com
Affected Version
29.4.0.24, 29.3, 29.2.2, 29.1.2
Tested On
iOS 27.2 (24B119)
Summary

Viber is a calling and messaging app that connects people - no matter who they are, or where they’re from. Each month, hundreds of millions of people connect, for free, with their loved ones via messaging, high-quality voice and video calls, and more. All one-on-one Viber calls and personal chats, and all group chats are protected by built-in end-to-end encryption, so you can be sure that your conversations are always secure.

Description

Viber for iOS doesn't validate the logical screen dimensions in the header of a received GIF. When the user opens the GIF, Viber builds a placeholder image sized from those dimensions by calling +[UIImage(Utils) imageWithColor:size:opaque:] (in ViberCoreUILegacy), which calls UIKit’s UIGraphicsBeginImageContextWithOptions. If the width or the height is zero, UIKit can't create the bitmap and raises an NSInternalInconsistencyException. Viber doesn't catch it, so the app aborts with SIGABRT on the main thread. Viber's servers relay the GIF unchanged, so any user can deliver it to any other user. Every GIF with a zero-width or zero-height canvas tested this way crashed, static and animated alike.

Proof of Concept
Disclosure Timeline
22.10.2026Vulnerability discovered.
05.11.2026Vendor contacted.
05.11.2026Vendor automatic reply: Viber Support Ticket #19849148: Viber for iOS, latest version, DoS 1-tap issue crashes Viber when parsing GIF image.
09.11.2026No response from the vendor.
10.11.2026Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
10.11.2026Initial release
11.11.2026Added reference [2], [3], [4] and [5]