An integer underflow bug exists in the PE::_parse_relocations routine of JusticeRage Manalyze version 1.0.0. The bug is triggered by manipulating the BlockSize argument, causing the internal counter to wrap around and potentially read or write outside the intended buffer. This defect is classified as CWE‑189 and CWE‑191. If an attacker can supply a crafted input to the parser while the application is running locally, the underflow could lead to memory corruption that may be leveraged for arbitrary code execution or a denial‑of‑service crash.

JusticeRage Manalyze 1.0.0 – the component containing the PE Parser. No other vendors or product versions are listed as affected at this time.

The CVSS score of 4.8 indicates a moderate severity, and the attack requires a local approach. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying that there are no known widespread exploits. The risk persists only on systems where Manalyze runs with sufficient privileges, and successful exploitation would likely result in local privilege escalation or application disruption rather than remote compromise.