Executive brief
A vulnerability in the Office Reader mobile application allows a malicious app installed on the same device to bypass security boundaries. By exploiting this flaw, an attacker can write unauthorized files into the Office Reader's private storage area. This can lead to a denial-of-service condition where the application crashes or becomes unusable due to storage exhaustion or corrupted internal data.
Technical details
A path traversal vulnerability (CWE-22) exists in the Office Reader Android application (net.sjava.officereader) within the file import process, specifically involving the 'joa.zipper.editor.Main' component. The root cause is insufficient validation of filenames and content during file imports via Intent actions. A local malicious application can craft a specialized Intent using path traversal sequences (e.g., ../) in the display name or URI parameters to write arbitrary files into the target app's internal data directory. This bypasses sandbox isolation and can be used to fill internal storage or overwrite critical files, resulting in a Denial of Service (DoS). The attack requires the victim to trigger the malicious app, which then interacts with the vulnerable Office Reader activity.
Affected products
- Moo Chan Song (ntoolslab) Office Reader - PDF,Word,Excel 4.5.7
Timeline
- 2026-01-30: disclosed: Vulnerability details and PoC shared on GitHub by Secsys-FDU
- 2026-02-04: advisory: CVE-2025-69620 published