# CVE-2026-50491 — Windows Code Integrity `ci.dll` Under-Validated `VS_VERSIONINFO` Parsing in the SIPolicy Version-Block Path → Out-of-Bounds Read / Type Confusion

---

## Summary

| | |
|---|---|
| **Product** | Windows — `ci.dll` (Code Integrity; WDAC / System Integrity policy engine) |
| **CVE ID** | CVE-2026-50491 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-125: Out-of-bounds Read + CWE-843: Type Confusion |
| **Delivery** | Local — a crafted image `VS_VERSIONINFO` resource evaluated by a Code Integrity / WDAC policy |
| **KB / Fixed build** | KB5101650 — `ci.dll` 10.0.26100.8875 (Win11 24H2 x64) |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary** | `ci.dll` 10.0.26100.8737 — SHA256 `ac205af767df30ce6e7b6614097c301898d0143863aaaaaa1dce500bc6ab3b70` |
| **Post-patch binary** | `ci.dll` 10.0.26100.8875 — SHA256 `18cc08a6bb3d0a1d4c7e503e7f9c79a2a100fe67f6352910cdad47944d3f8eb5` |
| **Feature flag** | `Feature_1311764795` / `Feature_2390291770` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`ci.dll` is the Windows Code Integrity module that enforces driver/image signing and
**Windows Defender Application Control (WDAC)** policy. WDAC rules can match an image
by its file version and **OriginalFilename**, which Code Integrity reads from the
image's `VS_VERSIONINFO` resource. The SIPolicy code walks that nested version-block
tree:

```
ci!SIPolicyGetOriginalFilenameAndVersionFromImageBase
  ci!SIPolicyGetVersionInfo            // VS_FIXEDFILEINFO
  ci!SIPolicyCheckVerBlock             // block header / length
  ci!SIPolicyQuerySubVerBlock          // \StringFileInfo\..., \VarFileInfo\Translation
  ci!SIPolicyQueryVersionFields        // extract version fields / strings
```

A `VS_VERSIONINFO` block is a tree of records, each with a `wLength`,
`wValueLength`, and `wType`, and (for the fixed block) a `VS_FIXEDFILEINFO` whose
signature is `0xFEEF04BD`.

---

## Vulnerability Summary

Pre-patch, the SIPolicy version-block parsers trusted each record's declared
`wLength` / value length / type **without validating them against the parent
block's bounds or verifying the `VS_FIXEDFILEINFO` signature**. A crafted version
resource therefore produced two defects:

- **Out-of-bounds read (CWE-125)** — a child block whose length/offset runs past the
  end of its parent block causes the walk to read past the buffer.
- **Type confusion (CWE-843)** — a node consumed as `VS_FIXEDFILEINFO` (or another
  fixed record type) without the `0xFEEF04BD` signature check is misinterpreted, so
  its fields are read at the wrong offsets/types.

Code Integrity / WDAC evaluation runs in kernel context, so a malformed parse of an
attacker-influenced image's version resource is a kernel OOB-read / type-confusion
primitive. Exploitation requires winning a race (`AC:H`); success yields SYSTEM
(per the MSRC FAQ).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`); `AC:H` — the attacker must get a crafted
  image parsed by a Code Integrity / WDAC policy check and win the associated race.
- Craft the image `VS_VERSIONINFO` so a sub-block length/offset exceeds its parent,
  or a fixed record lacks the correct signature.
- Result: OOB read / type confusion in the kernel Code Integrity parser.

---

## Vulnerability Details

### Root Cause

The nested `VS_VERSIONINFO` records were walked using their own declared lengths and
assumed types, without bounding each child against the parent block size or checking
the `VS_FIXEDFILEINFO` signature — so malformed lengths caused over-reads and
untagged nodes were mis-typed.

### The patch (confirmed — diff, .8737 → .8875)

Gated behind `Feature_1311764795` / `Feature_2390291770`, each parser adds bounds and
structure validation before reading a block:

```c
// SIPolicyGetVersionInfo (10.0.26100.8875) — PATCHED (from our diff)
if ( (0x5b < param_2) && (0x5b < *param_1) && (*param_1 <= param_2)   // block big enough & length within available size
     && (*(int *)(param_1 + 0x14) == 0xFEEF04BD) ) {                  // *** VS_FIXEDFILEINFO signature check ***
    *param_3 = /* fixed-file-info version */ ;
}

// SIPolicyCheckVerBlock (.8875) — PATCHED
if ( 7 < param_2 && 7 < uVar1 && uVar1 <= param_2 ) {
    RtlStringCbLengthW((short*)(param_1+3), uVar1-6, &len);
    uVar2 = ((len + 0xb) & 0xfffffffc) + param_1[1];   // aligned length + child offset
    if ( uVar2 <= *param_1 && param_2 >= uVar2 ) { /* descend */ }   // *** bound child against parent ***
}
```

`SIPolicyQuerySubVerBlock` likewise enforces even alignment (`(*param_1 & 1)==0`),
a range bound (`(ushort)(*param_1-8) < 0x7ff9`), a value-length bound
(`val <= len*2`) and a pointer bound while walking, and `SIPolicyQueryVersionFields`
adds signed-length and `< 0xffff` checks with `RtlStringCbLengthW` validation. With
each block validated against its parent and the fixed block's signature checked, the
over-read and the type confusion are both closed.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1311764795` / `Feature_2390291770`.** The hardened
parsing runs only when the flags are enabled; the original under-validating parser
still ships when disabled. Verify the flags are enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Code Integrity / WDAC evaluation of images carrying malformed
`VS_VERSIONINFO` resources (child block lengths/offsets exceeding the parent, fixed
blocks lacking the `0xFEEF04BD` signature); OOB-read / type-confusion bugchecks in
`ci!SIPolicyQuerySubVerBlock` / `SIPolicyGetVersionInfo` on unpatched/flag-disabled
builds.

**Config.** The fix is CFR-gated — confirm `Feature_1311764795` /
`Feature_2390291770` are enabled.

---

## References

- MSRC advisory — CVE-2026-50491 (Code Integrity DLL (ci.dll) Elevation of Privilege), released 2026-07-14, KB5101650.
- Full binary diff: `/data/patch_diffs/ci_dll-cve-2026-50491-ghidriff.md`