LoginSign Up
← Back to all sparks
Y

YARA

INFRA · APIS
Velocity2.5

Pattern matching tool for malware research and detection

virustotal.github.io/yara ↗

YARA 4.6.0 is the first minor in two years, and it is almost entirely bounds checks.

malware detectionmemory safetyparser hardeningcompiled rulesmaintenance mode
◆Current state
4.6.0 is YARA's first minor release since 4.5.0 in September 2024. It adds yr_get_version, nine more e_machine values in the elf module and a man-page sync; everything else is bug fixes across compiled-rule loading, the regex engine, the VM, ELF handling and Authenticode. Loading a compiled rule file now validates indices, external variables, arena buffers and Aho-Corasick states. The release credits Ada Logics and Anthropic among its contributors.
◆Where it's heading
The parser-under-pressure reading holds, with wider scope. Earlier patches bounded single values; this release treats compiled rules and regex input as hostile throughout. Fixes for exponential growth on nested regex repeats and infinite loops show the review now covers resource exhaustion as well as corruption.
◆Prediction
Expect 4.6.x patches in the same files, since this list is long and contributor-driven. Nothing here signals new language features; the three additions are small.

◆Recent moves

  1. 8d ago

    4.6.0: broad hardening of compiled rules, regex and the VM

    The batched patches of July become a full minor release, with about two dozen fixes against three small additions. It is the widest hardening pass in this window, centred on compiled rules and the regex engine.

    View source ↗
  2. 3mo ago

    Bounds checks across opcodes, dotnet and regex fibers

    Four separate bounds are imposed — rule table index in two opcodes, tilde stream row count in the dotnet module, repeat stack depth in the regex engine — alongside a leak fix in rule stream loading. For a scanner pointed at hostile files, this is the release that matters most in the batch.

    View source ↗
  3. 3mo ago

    Undersized rich headers and resource limits guarded

    Two PE module fixes: a guard against undersized rich headers, and aborting resource collection once the maximum is reached rather than continuing. Published nine minutes before 4.5.8, so in practice it reaches users as part of one batch.

    View source ↗
  4. 3mo ago

    Out-of-bounds read in .NET parsing fixed

    An out-of-bounds read while parsing .NET files, plus a symbol made non-public. The dotnet module keeps producing findings across this whole window, which says something about how much attack surface it carries.

    View source ↗
  5. 1y ago

    Version number corrected after a mislabeled tag

    A release whose entire content is fixing a version number, after 4.5.3 was incorrectly labelled 4.5.2. It carries no code change at all.

    View source ↗
  6. 1y ago

    Heap overflow from crafted compiled rules closed

    A heap overflow reachable by loading hand-crafted compiled rules is the serious item here — compiled rule files are frequently shared between organisations, so treating them as untrusted input matters. The regex scan limit is also reverted to its earlier value, and --no-follow-symlinks arrives on Windows.

    View source ↗