Denial of Service in WeChat Application by Altering Emoji Files
CVE-2019-11419

5.5MEDIUM

Key Information:

Vendor

Tencent

Status
Wechat
Vendor
CVE Published:
14 May 2019

What is CVE-2019-11419?

The WeChat application for Android is susceptible to a denial of service issue, enabling attackers to crash the app by manipulating emoji files. By replacing a standard emoji file in the specified directory with a specially crafted .wxgf file, an attacker can trigger a crash upon receiving a message that references the modified emoji. This attack is contingent on the replacement content being derived from the device's IMEI, underscoring the risk associated with file manipulation on the platform.

References

https://awakened1712.github.io/hacking/hacking-wechat-dos/
x_refsource_MISC
http://packetstormsecurity.com/files/152947/WeChat-7.0.4-...
x_refsource_MISC
https://www.exploit-db.com/exploits/46853
exploitx_refsource_EXPLOIT-DB

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.