Instagram bug that could have been exploited to spy on users found and fixed

A coding vulnerability in Instagram which could have given attackers unauthorised access to anyone’s phone contacts, camera and location data was detected by cybersecurity firm Check Point and fixed by Facebook seven months ago. Check Point’s findings on the vulnerability was made public today.

The vulnerability was identified by Facebook’s security team as “Integer Overflow leading to Heap Buffer Overflow” and was caused by a coding error in Mozjpeg, an open source project used by Instagram as their JPEG format image decoder.

It was found that when Mozjpeg tried to decompress an image of certain dimensions and beyond an allocated size, it triggered the bug which crashed the app and gave attackers access over Instagram app.