CVE-2021-45423

What it actually does

Stack-based buffer overflow in pe_exports allows out-of-bounds writes when NumberOfNames exceeds NumberOfFunctions, enabling arbitrary code execution.

Why it matters to the business

Processing untrusted PE files with the affected tool can lead to full system compromise, risking data theft or malware deployment on analyst workstations.

How an attack unfolds

An attacker supplies a crafted PE binary where the export directory sets NumberOfNames larger than NumberOfFunctions; when pev parses it, the loop overruns the stack array, overwriting return addresses or function pointers to achieve code execution.

How to fix it

No fixed version is published; replace pev with a maintained PE analysis tool or apply a manual patch that enforces bounds checking on offsets_to_Names using the smaller of NumberOfFunctions and NumberOfNames.

How to confirm the fix worked

Rebuild pev with the bounds check and confirm that files triggering NumberOfNames > NumberOfFunctions no longer cause crashes or unexpected execution; scan source for the original loop pattern in exports.c.

Typical attack path

1. Craft malicious PE file with manipulated export table (NumberOfNames > NumberOfFunctions)
2. Deliver file to target via email, download, or shared storage
3. Victim opens file with vulnerable pev binary
4. pe_exports performs out-of-bounds write during export parsing
5. Control flow is hijacked to attacker-supplied shellcode

How to detect it

Monitor process execution logs for pev crashes or unexpected child processes when handling PE files; inspect command-line arguments and file paths passed to pev for suspicious binaries.

What your security team should do

• Immediately restrict pev usage to trusted files only
• Inventory all instances of pev 0.81 and earlier across the environment
• Migrate to an actively maintained PE parser before the next audit cycle
• Add pev to the list of disallowed binaries in endpoint policy if alternatives exist