LoginSign Up
← Back to all sparks
Y

YARA

INFRA · APIS
Velocity5.0

Pattern matching tool for malware research and detection

virustotal.github.io/yara ↗

YARA ships bounds checks, not features — three patch releases published thirteen minutes apart.

malware detectionmemory safetyparser hardeningmaintenance modepe parsing
◆Current state
Every release in this window is memory safety work on the parsers. The July batch bounds the rule table index in two opcodes, the tilde stream row count in the dotnet module and the repeat stack depth in the regex fiber sync, and fixes a leak in rule stream loading. Earlier releases closed a heap overflow triggered by hand-crafted compiled rules, infinite loops on corrupt PE resource directories, and an integer overflow in ELF parsing. The three most recent tags were published within thirteen minutes of each other.
◆Where it's heading
YARA is being maintained as an input parser under adversarial pressure rather than developed as a language. The last release to add anything — 4.5.0, with unreferenced string rules, strict escape warnings and a slow-rule callback — is nearly two years back, and everything since has been bounding a value someone found a way to overflow. Even the scan limit change was a revert to a prior default.
◆Prediction
Expect the pattern to hold: batched patch releases whose contents are bounds checks in the PE, dotnet and regex paths, since that is where every recent finding has landed. Nothing in these entries suggests new language or module capability is queued.

◆Recent moves

  1. 9d ago

    Bounds checks across opcodes, dotnet and regex fibers

    Four separate bounds are imposed — rule table index in two opcodes, tilde stream row count in the dotnet module, repeat stack depth in the regex engine — alongside a leak fix in rule stream loading. For a scanner pointed at hostile files, this is the release that matters most in the batch.

    View source ↗
  2. 9d ago

    Undersized rich headers and resource limits guarded

    Two PE module fixes: a guard against undersized rich headers, and aborting resource collection once the maximum is reached rather than continuing. Published nine minutes before 4.5.8, so in practice it reaches users as part of one batch.

    View source ↗
  3. 9d ago

    Out-of-bounds read in .NET parsing fixed

    An out-of-bounds read while parsing .NET files, plus a symbol made non-public. The dotnet module keeps producing findings across this whole window, which says something about how much attack surface it carries.

    View source ↗
  4. 9mo ago

    Version number corrected after a mislabeled tag

    A release whose entire content is fixing a version number, after 4.5.3 was incorrectly labelled 4.5.2. It carries no code change at all.

    View source ↗
  5. 9mo ago

    Heap overflow from crafted compiled rules closed

    A heap overflow reachable by loading hand-crafted compiled rules is the serious item here — compiled rule files are frequently shared between organisations, so treating them as untrusted input matters. The regex scan limit is also reverted to its earlier value, and --no-follow-symlinks arrives on Windows.

    View source ↗
  6. 1y ago

    Mach-O loop, PE memory use and ELF overflow fixed

    An infinite loop iterating Mach-O regions, high memory consumption on corrupted PE files and an integer overflow parsing ELF — three formats, one failure mode. The pattern of corrupt-input handling repeating across every executable parser is established here and continues through the later releases.

    View source ↗