Executive brief
CAPEv2 is a malware analysis sandbox used by security teams to safely execute and study suspicious files. A vulnerability in its reporting system allows attackers to submit specially crafted files that crash the analysis process or prevent reports from being generated. This effectively blinds security researchers, making malicious software appear benign or causing the analysis platform to fail when processing certain samples.
Technical details
A denial-of-analysis vulnerability exists in the reporting/mongodb.py and reporting/jsondump.py components of CAPEv2. The issue stems from improper handling of deeply nested or oversized behavior data generated during dynamic analysis. When a submitted sample executes recursive behaviors (such as recursive process forking), it can exceed MongoDB's 16MB BSON document size limit or its 100-level nesting depth limit. Additionally, these structures can trigger recursion errors in the orjson library used for JSON serialization. An attacker can exploit this by submitting a sample that generates complex behavior, causing the reporting module to fail and resulting in incomplete or missing analysis reports.
Affected products
- kevoreilly CAPEv2 commit 52e4b43
Timeline
- 2025-05-17: other: Vulnerable commit identified
- 2025-10-20: disclosed: CVE published