4-Byte Heap Overflow To RCE In Minecraft
Hrvoje Misetic
OffensiveCon 2026 · Day 1 · Main Stage
This talk, presented by Hrvoje Misetic at OffensiveCon, delves into the intricate process of achieving remote code execution (RCE) in Minecraft's Bedrock Edition through a 4-byte heap overflow vulnerability. The research meticulously details the discovery of a critical flaw in a widely used image parsing library, `stb_image`, and outlines a sophisticated exploitation chain that navigates modern memory mitigations like Segment Heap and Control Flow Guard (CFG). Given Minecraft's immense popularity, boasting 85 million active players, a server-to-client RCE vulnerability represents a significant security risk, allowing malicious servers to compromise connecting players' machines.
AI review
Misetic takes a 4-byte heap overflow in a 7-year-old image library and builds a full server-to-client RCE chain through Segment Heap exploitation, a custom scripting language turned into an arb read/write primitive, and a CFG bypass via unhardened statically-linked OpenSSL — all on a UWP target hitting 85 million players. Every layer of the chain required original thinking under real constraints, and the live demo lands the shell. This is exactly what OffensiveCon exists for.