Executive brief
A security vulnerability exists in binwalk, a popular tool used for analyzing and extracting data from firmware images. When a user processes a specially crafted Windows CE (WinCE) firmware file, the tool can be tricked into writing files to unintended locations on the computer. This could allow an attacker to gain control over the system by overwriting critical files or planting malicious software that runs the next time the tool is used.
Technical details
A path traversal vulnerability exists in the WinCE Extraction Plugin (winceextract.py) of OSPG binwalk versions up to 2.4.3. The root cause is the improper validation of the 'self.file_name' argument within the 'read_null_terminated_string' function, which fails to sanitize directory traversal sequences (e.g., '../'). An attacker can exploit this by providing a maliciously crafted WinCE ROM firmware image; when binwalk attempts to extract it, the tool writes files outside the intended extraction directory. This can be escalated to Remote Code Execution (RCE) by overwriting or planting a malicious binwalk plugin in the user's plugin directory. The maintainer has stated the product is End-of-Life (EOL) and recommends migrating to binwalk v3.
Affected products
- OSPG binwalk up to 2.4.3
Timeline
- 2026-04-27: disclosed: Vulnerability disclosed publicly with PoC.
- 2026-04-27: advisory: CVE-2026-7179 published.
- 2026-04-27: other: Maintainer confirmed EOL status and no planned fix.