Mobile Dynamix PrinterShare Mobile Print CVE-2025-5999 Out-of-bounds Write Vulnerability Analysis

Critical Vulnerability Information 1. Vulnerability Details Affected Product: Mobile Dynamix PrinterShare Mobile Print Affected Versions: up to 32.15.01 CVE Classification: - CWE-19: Improper Restriction of Operations within the Bounds of a Memory Buffer. - CWE-787: Out-of-bounds write CVE ID: CVE-2025-5999 2. Vulnerability Description An out-of-bounds write occurs when the native library attempts to process PDF rendering, which can be exploited to cause memory corruption and potentially lead to arbitrary code execution. 3. Technical Description Tested on Android 11 aarch64 - Samsung Rooted device. Frida client running on Ubuntu 24.04 LTS. The vulnerability resides in the libpdf.so component, which is triggered when processing PDF files with manipulated dimensions and structures due to insufficient boundary checks. The vulnerability is accessed via the ActivityPrintDocuments class, which is launched when opening a PDF file. PDF rendering occurs in class j (subclass of h), which invokes the vulnerable native function. The shared object function performs memory operations without proper validation, allowing attackers to manipulate memory via carefully crafted inputs. A Frida script was used to create a crash function specifically targeting Java.com.dynamixsoftware.printershare.PDFRender. It generates a PDF file containing values such as 0xFFFFFFF or INT_MAX, designed to trigger buffer overflow conditions. When used with corrupted parameters, it results in memory corruption. 4. Mitigation and Remediation Recommendations No response from the vendor; no known mitigations for end users of affected application versions. 5. Discoverer This vulnerability was discovered by Felix Segoviano of Korelogic, Inc. 6. Disclosure Timeline 2025-04-08: Korelogic requested contact with vendor for security disclosure. 2025-04-11: First contact with vendor. 2025-04-20: Second contact with vendor. 2025-05-22: Korelogic public disclosure.

Goal Reached Thanks to every supporter — we hit 100%!

Mobile Dynamix PrinterShare Mobile Print CVE-2025-5999 Out-of-bounds Write Vulnerability Analysis