---
id: 8648
title: "Fuzzing ImageIO"
source_domain: projectzero.google
source_url: "https://projectzero.google/2020/04/fuzzing-imageio.html"
published_at: "2020-04-28T00:00:00Z"
tags: ["fuzzing", "apple", "project-zero", "imageio"]
phying_url: "https://phying.com/item/8648"
lang: en
---

# Fuzzing ImageIO

## Summary

This blog post discusses an old type of issue, vulnerabilities in image format parsers, in a new(er) context: on interactionless code paths in popular messenger apps. This research was focused on the Apple ecosystem and the image parsing API provided by it: the ImageIO framework. Multiple vulnerabilities in image parsing code were found, reported to Apple or the respective open source image library maintainers, and subsequently fixed. During this research, a lightweight and low-overhead guided fuzzing approach for closed source binaries was implemented and is released alongside this blogpost.

## Intelligence Metadata

- **Sources:** projectzero.google
- **Published:** 2020-04-28T00:00:00Z
- **Original:** https://projectzero.google/2020/04/fuzzing-imageio.html
- **Phying News:** https://phying.com/item/8648