I read an article a while back (forgot from where) that essentially stated that someone wrote a virus and inserted it into an image. The end result allowed the cracker to have his way with the system.

How is this possible?

  • Do you mean image as in picture file like JPEG/BMP or disk image? Mar 15, 2012 at 22:32
  • Picture file. I can't image how easy it must be place a virus into a disk image.
    – ahodder
    Mar 15, 2012 at 22:33

4 Answers 4


Using this would generally depend on a fairly simple fact: most images are compressed. Along with this, the code to de-compress an image is often written assuming that the data in the image was compressed according to a fairly specific set of rules.

At times, however, people have found various vulnerabilities, chiefly that old standby, the buffer overrun, in image decompression code. By writing a file that does not follow the rules expected by the decompressor, they can figure out a way to overrun a stack-allocated buffer, and write data outside the allocated space on the stack.

From there, it's a fairly typical buffer-overflow attack, which are widely enough documented that there's no real point in my trying to go into it here.

  • 1
    Yepp, the correct answer. Wikipedia's article on buffer overflow is fairly informative, and even links to the famous GDI+ JPEG buffer overflow vulenrability which may well be exactly what the OP was asking about.
    – Daniel B
    Mar 16, 2012 at 8:37
  • Note that there are other things in image files that can be exploited if improperly implemented, such as image metadata.
    – tdammers
    Mar 16, 2012 at 8:53

It's possible to hide information (text, data, anything) in a image using steganography technique.

If an executable is hidden in a image, it still needs to be executed to infest your system. In practice, it depends on how you open the image, depending on the software/OS you use to open it.

  • I know about stenganography injection, but I didn't think it could be executed with out the used a decryptor. Naturally the software would have to be executed, but as I recall, it was executed after as the image opened (my memory may be faulty on this), but if that is the case, then I am further boggled....
    – ahodder
    Mar 15, 2012 at 21:54

Simple. He also smuggled in a (most likely) vbs script, that did the actual job of extracting the virus code from the picture and executing it. Not very different from just double clicking the BeautifulGirls.exe attachment that was arriving in your inbox 5-6 years ago.

  • and the vbs script will be launch / execute by ?
    – Nettogrof
    Mar 15, 2012 at 22:03
  • Strictly hypothetically speaking, by autorun.inf script on a cd/usb.
    – Jas
    Mar 15, 2012 at 22:14
  • why is that better than just putting the virus code in the vbs script directly?
    – psr
    Mar 16, 2012 at 3:41
  • @psr - Who said anything about being "better" ?
    – Jas
    Mar 16, 2012 at 9:35

Suppose there is a buffer overflow bug in an image loading/processing module. It could be possible to create an image that triggers the bug and injects malicious code this way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.