The Patching Friars' AlmanacA calendar of CVE saints

Patron of March 17

aCropalypseHoly card for acropalypse, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 ...leftover aCropalypse QUOD SECTUM MANET
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint aCropalypse, Who Did Not Really Crop

Patron of cropped screenshots, edited images, and anyone who thinks deleting is enough.

Life

On 17 March 2023 Simon Aarons and David Buchanan revealed aCropalypse. Google's Pixel Markup tool, when it cropped or redacted a screenshot, saved the file over the original without truncating it: the "deleted" part stayed at the end and could largely be reconstructed. The same flaw hit the Windows Snipping Tool. Millions of shared images still held what people thought they had removed.

Prayer

O Saint aCropalypse, who keeps what we thought was cut, teach our editors to truncate the file for real. Amen.

How to celebrate

Celebrated by updating the screenshot tools and, when in doubt, cropping sensitive images twice.

Crop an image badly, and the secret stays at the bottom.

Technical record

Disclosed on
March 17 2023
CVE
CVE-2023-21036CVE-2023-28303
CVSS
5.5
Product
Microsoft · Android

In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidVersions: Android kernelAndroid ID: A-264261868References: N/A

Sources: acropalypse.info · da.vidbuchanan.co.uk · x.com

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.