
Responsible disclosure: Easy Grade Pro .EGP file parsing flaw (Denial of Service)

Hello Orbis Software Team,

My name is Alejandro Vazquez Vazquez. You can find my LinkedIn profile here for background reference: https://www.linkedin.com/in/vazquez-vazquez-alejandro/. In addition to my day-to-day work as a cybersecurity researcher, I also dedicate part of my time to independently testing software products in search of logic flaws, stability problems, and security-related weaknesses, which I report responsibly to the corresponding developers. For this reason, I am contacting you.

I analyzed how Easy Grade Pro processes its proprietary .egp gradebook files and I identified a flaw in the way the application reconstructs internal data structures from file contents. Specifically, the application relies on fixed offsets and length assumptions when parsing several fields (such as student names, class labels, and custom field identifiers) without sufficiently validating their actual size.

By modifying the length of certain fields within an otherwise valid .egp file, it is possible to alter the expected layout of the file in a way that causes incorrect offset calculations during parsing. As a result, the application may attempt to read memory outside of allocated buffers via memcpy-based routines, ultimately leading to an unhandled access violation and a full application crash (denial of service).

This behavior appears to be the consequence of a file parsing logic flaw rather than intentional unsafe functionality. The software assumes a rigid internal file structure, and when those assumptions are violated by malformed but structurally valid input, the program does not gracefully handle the resulting inconsistencies.

Key details:
- Affected product: Easy Grade Pro for Windows
- Tested version: 4.0 (earlier 3.x versions are likely affected as well)
- Issue type: File parsing logic flaw leading to an out-of-bounds read
- Impact: Local denial-of-service (application crash)
- Attack vector: User opens a specially crafted .egp file
- No arbitrary code execution was observed

My intention in reaching out is to ensure transparency and responsible disclosure before publishing technical documentation describing the flaw and its impact. If there is an active maintainer, successor organization, or security contact associated with Easy Grade Pro, this notification is intended to provide awareness of the issue and allow for any appropriate action to be considered.

If you would like additional technical details or a proof-of-concept demonstrating the crash condition, I would be happy to provide them.

Kind regards,
Alejandro
