The DNG Weird Machine: Deconstructing an In-The-Wild Android Image Exploit
Benoît Sevens
OffensiveCon 2026 · Day 2 · Main Stage
This talk by Benoît Sevens from Google's Threat Analysis Group (now Google Threat Intelligence Group or GTIG) delves into a sophisticated in-the-wild Android exploit targeting the Digital Negative (DNG) image parsing library. The research, initially prompted by a sample discovered and shared by Meta, sheds light on advanced exploitation techniques used against a less-documented Android attack surface. While similar deep-dive analyses often focus on iOS image parsing exploits, this presentation offers a rare glimpse into the Android ecosystem, revealing a powerful exploit chain that leverages a single vulnerability to gain significant access.
AI review
Sevens walks through a real in-the-wild Android exploit chain — single OOB write in a proprietary Samsung image parsing library, escalated to arbitrary write via a minus-infinity delta trick, deterministic heap shaping against Scudo's LIFO behavior, and an ASLR bypass through type confusion without any initial read primitive. This is original TAG reverse engineering work on a live commercial spyware sample, not a CTF writeup or vendor retrospective.