Large heap overflow in Facebook Instagram for Android during image upload

A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affects versions prior to 128.0.0.26.128.

• Facebook Instagram for Android: versions less than 128.0.0.26.128 are affected.
• 128.0.0.26.128 is marked unaffected in the CNA record.
• The supplied data does not establish the status of later or parallel release branches beyond this exact boundary.

The CNA describes a large heap overflow in the image-upload path of Instagram for Android and classifies it as CWE-680, Integer Overflow to Buffer Overflow. The attacker-controlled input is the image's dimensions, which are specially crafted. A likely mechanism is an integer calculation or size validation error that leads to an undersized heap allocation or an oversized write; this is an inference from the weakness class, not a disclosed implementation detail. The supplied attack characteristics indicate local reachability, low complexity, no required privileges, and required user interaction. The exact parser, arithmetic operation, allocation site, overwritten data, and resulting primitive are not established.

The supplied attack characteristics describe a local attack path rather than direct network reachability. No privileges are required, complexity is low, and user interaction is required, consistent with the image-upload condition in the description. The record does not provide evidence about observed exploitation, public exploit code, or ransomware use. It also does not establish the delivery channel for a crafted image or whether exploitation can proceed beyond the Instagram process.

The recorded outcome includes high potential confidentiality, integrity, and availability impact within an unchanged security scope. A successful memory-corruption event could therefore affect the Instagram application's data handling or availability without the record proving a cross-scope compromise. The supplied metric records no required privileges and required user interaction; these are stated triggering conditions, not evidence that the risk is absent. Specific outcomes such as code execution, account takeover, data disclosure, or persistent device compromise are not established by the supplied evidence.

A successful trigger could disrupt the Instagram process or device-side application behavior through memory corruption. The supplied impact assessment records high potential effects on confidentiality, integrity, and availability, with unchanged scope. For an organization, this could require incident review, application recovery, or device remediation, but the record does not establish account takeover, data theft, or a breach.

1. Update Facebook Instagram for Android to 128.0.0.26.128, the exact release marked unaffected in the supplied record.
2. Inventory Android devices that run Instagram for Android and prioritize installations below the unaffected release boundary for update.
3. Confirm the update through Android application inventory and retain evidence of rollout. No vendor-specific workaround or mitigation is provided in the supplied record.

1. Inventory Instagram for Android across managed Android devices and record installed versions.
2. Compare each installed version with the affected and unaffected boundaries in affected_summary; prioritize devices that fall below the recorded unaffected release.
3. Review crash, ANR, and support telemetry for failures that coincide with image-upload attempts or unusually crafted image dimensions. Treat this as precautionary review because the record does not define a specific log event or indicator.
4. Do not treat the absence of matching telemetry as proof that a device is not exposed; version verification is the primary check.