# Facebook Messenger server random memory exposure through corrupted GIF image

Corrupted GIF with no image data caused Facebook Messenger web to render uninitialized server memory as pixel noise, leaking prior buffer contents.

- Payout: $10,000
- Severity: medium
- Program: Meta / Facebook
- Credited: Dzmitry Lukyanenka
- Disclosed: 2019-03-06
- Write-up quality: 7/10
- Original: https://www.vulnano.com/2019/03/facebook-messenger-server-random-memory.html
- Library page: https://bugbountylibrary.com/r/blog%3Avulnano-com-2019-03-facebook-messenger-server-random-memory-html
- Tags: domain:web impact:data-leak kind:bounty platform:blog sev:medium tech:php technique:fuzzing technique:source-review vuln:info-disclosure

**Target:** GIF image processing/rendering endpoint in Messenger web
**Root cause:** Server-side GIF decoder rendered images lacking image data blocks, reading from an uninitialized/reused buffer instead of zeroing it, exposing prior memory contents as pixels.
**Steps:**
1. Craft minimal GIF89a with logical screen and image descriptor but omit LZW min code size, data blocks, and block terminator; jump straight to trailer `0x3b`.
2. Upload the GIF to Facebook Messenger web.
3. Observe rendered image is white noise / prior buffer contents rather than empty.
4. Vary screen/image width and height fields to shift the leaked buffer region.
5. Re-upload same binary and observe image changes, confirming uninitialized memory reuse.
**How found:** Inspired by ImageMagick gifoeb uninitialized memory disclosure; Android app only crashed (no bounty), so pivoted to Messenger web and noticed empty GIFs returned noise images, hypothesizing a reused buffer read when no image data present.
**Exploitation:** Attacker uploads crafted GIF to Messenger; server decodes and returns rendered image whose pixels are drawn from uninitialized memory, leaking residual server buffer data to the attacker.
**Insight:** When a decoder accepts structurally incomplete files (missing data blocks), test whether output reflects stale buffer contents; varying dimension fields shifts which memory region leaks, and re-uploading identical bytes changing output confirms uninitialized memory rather than deterministic rendering.