5.5
CVSSv3

CVE-2023-21036

Published: 24/03/2023 Updated: 29/03/2023
CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8
VMScore: 0

Vulnerability Summary

In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidVersions: Android kernelAndroid ID: A-264261868References: N/A

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

google android -

Github Repositories

aCropalypse gif aCropalypse(CVE-2023-21036)related GIF PoC The aCropalypse reported affects PNG, but a similar exploit exists in GIF images PoC This is original GIF Image case02gif

Discord bot for mitigating the aCropalypse vulnerability (CVE-2023-21036, CVE-2023-28303) by retroactively deleting vulnerable images

March 31st, 2023 Update As of today, Discord's CDN now strips trailing data from PNGs in-flight, meaning that even old uploads are now safe from the aCropalypse vulnerability As such, this bot is no longer necessary, but it will remain online to allow users to download their archived images The original README for the bot can be found below AntiCropalypse Discord bot wh

Discord bot for mitigating the aCropalypse vulnerability (CVE-2023-21036, CVE-2023-28303) by retroactively deleting vulnerable images

March 31st, 2023 Update As of today, Discord's CDN now strips trailing data from PNGs in-flight, meaning that even old uploads are now safe from the aCropalypse vulnerability As such, this bot is no longer necessary, but it will remain online to allow users to download their archived images The original README for the bot can be found below AntiCropalypse Discord bot wh

Web tool for detecting Acropalypse (CVE-2023-21036) https://lordofpipes.github.io/acropadetect/

Acropadetect Web tool for detecting Acropalypse (CVE-2023-21036)

Acropalypse Detection Tool Built in go supports recursive directory scanning, based from githubcom/infobyte/CVE-2023-21036 Build $ go build Usage $ acropalypse_detector <directory/file>

CVE-2023-21036 detection in Go

gocropalypse CVE-2023-21036 detection in Go All credit to Simon Aarons and David Buchanan and infobyte How to use Go version go run gocropalypsego /path/to/dir How to use Python version python3 acropalypse_dirpy /path/to/dir

Discord bot for mitigating the aCropalypse vulnerability (CVE-2023-21036, CVE-2023-28303) by retroactively deleting vulnerable images

March 31st, 2023 Update As of today, Discord's CDN now strips trailing data from PNGs in-flight, meaning that even old uploads are now safe from the aCropalypse vulnerability As such, this bot is no longer necessary, but it will remain online to allow users to download their archived images The original README for the bot can be found below AntiCropalypse Discord bot wh

Easily detect and restore Acropalypse vulnerable PNG and GIF files with simple Python GUI.

Acropalypse Restoration and Detection Multi-Tool A Comprehensive Solution for Acropalypse-Affected Images Easily restore PNG and GIF files that have fallen victim to the Acropalypse CVE from 2023 This all-in-one solution effectively recovers image data accidentially stored in cropped screenshots by Google Pixel phones or Windows Snipping Tool, and can search and detect vulnera

StarlightCTF is a repository containing notes pointing to ideas and resources It's purpose is to help the user (usually me) to find solutions to security-related challenges and provide some tools to use when offline The resources that I use most often are marked with a heart ❤️ symbol This database was inspired by CTF Katana (unmaintained) and HackTricks (pentest-or

Recent Articles

Privacy fail: Pictures cropped, redacted by Google Pixel phones can be recovered
The Register

Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources aCropalypse Now, starring any 2018-or-later device

If you've owned a Google Pixel smartphone since the 3 series came out in 2018, bad news: any screenshot that you've cropped or redacted on your Pixel can be potentially restored without much fuss. Reverse engineers Simon Aarons and David Buchanan, who found the bug and produced a proof-of-concept recovery tool, respectively, dubbed it aCropalypse, and noted "this bug is a bad one" for folks concerned about their privacy.  The flaw lies in how Google's image-editing app Markup, available for...