Arbitrary Code Execution in InPage InPage100 Stream Parsing

Successful exploitation allows execution of attacker-controlled shellcode in the context of the InPage reader. Observed exploit chains decrypted an embedded executable payload and downloaded and executed additional malware, including keyloggers and backdoors.

Until patching is complete, prevent or strictly limit opening of untrusted or externally sourced .inp documents, especially those received through email or messaging channels. Use attachment detonation or sandboxing for InPage documents, enforce application allowlisting, and isolate systems that require InPage from general internet access where feasible. Harden endpoints with exploit mitigations and EDR capable of detecting abnormal child-process execution, shellcode behavior, and downloader activity originating from InPage. Restrict user privileges to reduce post-exploitation impact and consider blocking InPage document handling on systems where the software is not operationally required.

Apply the vendor-provided security update or upgrade to a fixed version of InPage that corrects validation of document stream fields and prevents out-of-bounds access during parsing of InPage100 content. If a patched release is not available for the deployed version, migrate users to a supported version that includes the fix. Validate that vulnerable legacy InPage installations are removed from endpoints used to open untrusted .inp files.