NITF and NSIF embedded content rules

A NITF or NSIF file can carry JPEG, JPEG 2000, EMF, WMF, H.264 and H.265 content and SIDD data extension segments. Glasswall Genesis inspects each with the format's own rules, and you set the action for any of them in the extendedFormatSettings section of a content management policy under overrides.<format>, where the format is one of jpeg, jpeg2000, emf, wmf, h264, h265 or sidd. See Configuring NITF and NSIF protection for the section itself and the rules for the NITF structure.

These rules apply only to content inside a NITF or NSIF file. A standalone file of one of these formats is not processed by Genesis.

Each rule is listed with its name and ID, either of which can be used as a key under rules. reject is offered by every rule and is not repeated in the Configurable actions column. Compliance lists the sources that back the rule: spec is the format specification, isg is the NSA Inspection and Sanitization Guidance, cve is a published vulnerability, gw is Glasswall research. Impact is the rule's change tier.

JPEG (jpeg)

app0-jfif-marker-segment

A buffer overflow data attack may occur if 'JFIF' is a non-zero terminated string. Unknown versions may contain different or more data that is unprocessed by applications. The thumbnail data is uncompressed RGB data and must be exactly 3 * width * height bytes or data may be hidden.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
jfif-app0-segment	gw-2ASADSX	Detect a JFIF APP0 marker segment present in the file	remove	remove report omit	isg; gw	visual
jfif-density-units	gw-AJNQQKZ	Detect a JFIF APP0 density unit that is not 0, 1 or 2	report	report replace omit	spec; isg; gw	structural
jfif-identifier-null-terminated	gw-DCA7TQN	Detect a JFIF APP0 identifier that is not a zero-terminated 'JFIF' string	report	report replace omit	spec; isg; gw	structural
jfif-thumbnail-data-size	gw-CM50D74	Detect JFIF APP0 thumbnail data whose size is not exactly 3 * Xthumbnail * Ythumbnail bytes	report	report omit	spec; isg; gw	structural
jfif-version	gw-P9PFBMN	Detect a JFIF APP0 version other than 1.02	report	report omit	spec; isg; gw	structural

app0-thumbnail-image

The image of the file and the thumbnail are not required to be of the same image. Data disclosure or data hiding are risks if the encoded image and thumbnail image are different. The thumbnail may reveal content not visible in the main image, or may be a different image entirely, resulting in inadvertent data disclosure.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
jfif-thumbnail	gw-V395XX2	Detect an uncompressed thumbnail image embedded in the JFIF APP0 marker segment	remove	remove replace report omit	isg; gw	visual

application-marker-segments

Application developers can decide how to use an application marker segment. Any type of data may be placed in an application marker segment allowing for data hiding, data disclosure and data attack concerns.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
adobe-colour-transform-marker	gw-HQW0PNP	Detect the Adobe APP14 color-transform marker on a four-component (CMYK/YCCK) image, where it is the sole color-space declaration	replace	replace remove report omit	isg; gw	visual
all-application-markers	gw-9R5YGRR	Detect APP0-APP15 application marker segments that may carry arbitrary application-defined data	remove	remove report omit	isg; gw	functional
application-marker-content	gw-KDKSD11	Detect identifiable data types within application marker segments (text strings, JFIF thumbnail images, Exif metadata) that require external filtering	report	report omit	isg; gw	functional
unapproved-application-markers	gw-6PQEBBP	Detect application marker segments that are not on the approved application marker segment list	remove	remove report omit	isg; gw	functional

comment-marker-segments

Any data may be stored in a COM marker segment. Data hiding is possible since arbitrary data can be purposefully placed in the comment marker segment. Comments may contain information not intended for distribution, resulting in inadvertent data disclosure.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
comment-markers	gw-12TH0XN	Detect COM (comment) marker segments that may carry arbitrary text, metadata or hidden content	remove	remove replace report omit	isg; gw	visual

content-identity

A foreign container mis-identified as JPEG by its extension (e.g. a DjVu named .jpg—the CVE-2021-22204 delivery vector) is forwarded unchanged by a fail-open passthrough, and different downstream consumers route it to different parsers (a parser-differential / identification-divergence smuggling channel). An identified-but-unsupported JPEG subformat left unrecognized would be unrouted, so a container would pass it through untouched (a CDR bypass), while attempting to remediate it as baseline T.81 would corrupt it. Refusing the mis-identified or unsupported file closes the divergence so validate and protect agree, and no non-JPEG—or undecodable JPEG variant—is delivered under a JPEG name.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
foreign-container-magic	gw-AZCDPHB	Detect a file presented as JPEG whose leading magic bytes identify a different, recognized container format, or that has no recoverable JPEG SOI (start-of-image) marker	reject	—	cve; gw	structural
t851-arithmetic-extension-unsupported	gw-T851GAP	Detect a file that opens with the ITU-T T.851 JPG file-identifier (FF C8 00 05 'ac2'), an arithmetic-coding extension Genesis cannot decode	reject	report omit	spec; gw	structural

dependent-marker-segments

The presence of a dependent marker segment without the marker segment which is depended upon, or with an out-of-spec conditioning / expansion value, may indicate data hiding or a corrupted JPEG image and steers decoders apart.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
dac-conditioning-valid	gw-DACB6X1	Detect an arithmetic conditioning (DAC) segment whose Tc/Tb/Cs value-space is out of spec (Table B.6)	reject	report omit	spec; isg; gw	structural
dependent-differential-frame-requires-dhp	gw-HPDDJY6	Detect a differential frame header present without a required DHP marker segment	reject	report omit	spec; isg; gw	structural
exp-expand-geometry-valid	gw-EXPB3X1	Detect an EXP (expand reference components) segment whose length or Eh/Ev expansion nibble geometry is out of spec	reject	report omit	spec; isg; gw	structural
exp-requires-dhp	gw-KJTS9J6	Detect an EXP marker segment present without a required DHP marker segment	reject	report omit	spec; isg; gw	structural
rst-requires-dri	gw-M73DZRW	Detect an RST marker segment present without a required DRI marker segment	reject	report omit	spec; isg; gw	structural
tem-requires-arithmetic-frame	gw-5T4XVWA	Detect a TEM marker segment present without a required arithmetic coding frame	reject	report omit	spec; isg; gw	structural

entropy-coded-image-data

Known steganography tools manipulate the DCT coefficients by embedding information within the entropy coded image data. The most popular method is to use the least significant bits (LSBs) of the DCT coefficients. If a binary program were located within or completely replaced the entropy coded image data, attempting to process the image can be a data attack.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
dct-coefficient-lsb-steganography	gw-SXBGNFH	Detect potential steganography in the least significant bits (LSBs) of the DCT coefficients	report	report replace omit	isg; gw	visual
entropy-data-executable-scan	gw-18VPVCF	Detect known executable signatures within entropy coded segments	report	report omit	isg; gw	structural
entropy-data-recompress	gw-MVE59CW	Detect entropy coded image data that may conceal hidden data recoverable by decompression and lossy recompression	report	report replace omit	isg; gw	visual
entropy-stream-decodable	gw-KWJMMG4	Detect an entropy coded stream or Huffman tables that fail a full decode, indicating a malformed or inconsistent codestream	report	report omit	spec; isg; gw	structural

exif-app-marker

Exif markers can add any kind of data that TIFF supports making it a high risk for data hiding. Since a processing application must use a TIFF parser to parse the contents, an attacker could use a vulnerability in the TIFF parser. The TIFF may also include a thumbnail. Exif metadata may contain camera details, geolocation data, timestamps and other information not intended for distribution, resulting in inadvertent data disclosure.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
exif-identifier-null-terminated	gw-56BJWZS	Detect an Exif APP marker identifier that is not zero terminated with an additional zero byte of padding	report	report omit	spec; isg; gw	structural
exif-marker	gw-J0R5DWV	Detect an Exif APP1 marker segment present in the file	remove	remove report omit	isg; gw	functional
jfif-exif-exclusivity	gw-RFGTYGQ	Detect both a JFIF APP marker and an Exif APP marker present when only one is permitted	report	report omit	spec; isg; gw	structural
single-exif-marker	gw-HX687SE	Detect more than one Exif APP marker present in the file	report	report omit	spec; isg; gw	structural

frame-header

A malformed frame header (missing component parameters) may cause a JPEG decoder to crash or malicious code to run. If there are more lines in the decompressed image than the Number of lines parameter, viewers will truncate the image data, hiding additional image content from the user.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
extraneous-frame-lines	gw-8RQE1ZF	Detect extraneous bytes exceeding the Number of lines parameter	remove	remove report omit	isg; gw	structural
frame-component-count	gw-C141K8G	Detect a frame header Number of components parameter that disagrees with the count of component parameters present	reject	report omit	spec; isg; gw	structural
frame-deep-precision	gw-JQ7VK2M	Detect a coding frame declaring a sample precision above 8 bits (12-bit or 16-bit deep precision)—the decoder-attack shape behind CVE-2023-2804 (12-bit h2v2 merged upsample). Genesis's managed 8-bit codec cannot normalize deep-precision samples, so such a file is otherwise forwarded unremediated; reject it rather than passing a live trigger to a downstream native decoder.	reject	report omit	cve; gw	structural
frame-header-well-formed	gw-FHCJBZN	Detect a frame header (SOF) with an out-of-range sample precision, component sampling factor or quantization-table selector; a sampling-factor sum (Σ Hi×Vi) exceeding 10; or a quantization-table selector that resolves to no defined DQT	reject	report omit	spec; gw	structural
frame-line-count	gw-3E3NGX1	Detect a frame header Number-of-lines (Y) = 0 with no DNL marker segment to define the image height, an undefined-height header decoders resolve divergently	reject	report omit	spec; isg; gw	structural

frames

An image with more than one frame may be at risk of data hiding. Non-differential frames are stand-alone images; if more than one non-differential frame is present, data hiding may exist as unseen images. Hierarchical images are not well supported in open source libraries or commercial tools. A frame encoded with a codec or subformat Genesis cannot fully decode and re-encode (arithmetic, lossless, high-precision, JPEG-LS or an abbreviated / frameless stream) would otherwise be copied through uninspected as an alternate-codec hidden-content channel.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
dhp-precedes-differential-frame	gw-JTZQCSA	Detect a first differential frame that is not preceded by a DHP marker segment	reject	report omit	spec; isg; gw	structural
differential-frame-requires-dhp	gw-HJM58AJ	Detect differential frames present without a DHP marker segment	reject	report omit	spec; isg; gw	structural
hierarchical-image	gw-PD7MA5Y	Detect a hierarchical image, an uncommon structure that can be restructured into a baseline JFIF image	replace	replace report omit	isg; gw	visual
single-non-differential-frame	gw-NYG94BW	Detect more than one non-differential frame in the image	reject	report omit	spec; isg; gw	structural
unsupported-codec-mode	gw-2K9XTR4	Detect a JPEG codec or subformat Genesis cannot fully decode and re-encode (arithmetic coding SOF9/10/11/13/14/15, lossless SOF3/7/11/15, sample precision above 8 bits, JPEG-LS SOF55/LSE or an abbreviated / frameless stream) whose entropy codestream would otherwise be copied through uninspected	reject	report omit	spec; isg; gw	structural

icc-profile

An ICC profile is an embedded object adhering to an independent data format. Its data disclosure, hiding and attack risks must be subjected to the same level of scrutiny as the JFIF file that contains it. The ICC profile may contain metadata revealing information about the color processing pipeline or device characteristics not intended for distribution.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
icc-profile-present	gw-QXZH1S2	Detect an ICC profile embedded in an APP2 marker segment	remove	remove replace report omit	isg; gw	visual
icc-profile-valid	gw-SE1YSAZ	Detect an ICC profile that does not conform to the ICC format specification	report	report omit	spec; isg; gw	structural

image-boundaries

The length between SOI and EOI markers is unconstrained; extra bytes may exist between markers and marker segments allowing data hiding. Data after the EOI is typically ignored by decoders and represents hidden data.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
data-after-eoi	gw-EZVBV08	Detect data present after the EOI marker	remove	remove report omit	isg; gw	structural
data-before-soi	gw-DZHDRQ7	Detect data present before the SOI marker	remove	remove report omit	isg; gw	structural
eoi-last	gw-Y1R85SA	Detect a file whose final bytes are not the EOI marker	reject	—	spec; isg; gw	structural
inter-marker-gaps	gw-RMYCGBT	Detect extra bytes in the inter-marker gaps of the JFIF structure that could conceal hidden data, including the 0xFF fill bytes T.81 B.1.1.2 permits before a marker	remove	remove	isg; gw	structural
markers-adjacent	gw-WK26XQE	Detect a marker or marker segment between SOI and EOI that is not directly adjacent to another marker or marker segment	reject	report omit	spec; isg; gw	structural
single-soi-eoi-pair	gw-MQS9694	Detect more than one SOI marker or more than one EOI marker in the file	reject	—	spec; isg; gw	structural
soi-first	gw-2YF03JJ	Detect a file whose first bytes are not the SOI marker	reject	—	spec; isg; gw	structural

jfif-extension-marker-segment

A buffer overflow data attack may occur if 'JFXX' is a non-zero terminated string. An unknown extension type would allow a block of data not processed by viewers, representing a data hiding risk.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
jfxx-extension-code	gw-S1FVNV6	Detect a JFXX extension code that is not one of 0x10 (JPEG thumbnail), 0x11 (1 byte/pixel) or 0x13 (3 bytes/pixel)	report	report omit	spec; isg; gw	structural
jfxx-identifier-null-terminated	gw-P4ETZVG	Detect a JFXX APP0 identifier that is not a zero-terminated 'JFXX' string	report	report replace omit	spec; isg; gw	structural
jfxx-segment	gw-BCPK0QF	Detect a JFXX extension APP0 marker segment present in the file	remove	remove report omit	isg; gw	visual
jfxx-unknown-extension	gw-C9D4GR1	Detect a JFXX extension segment whose extension code is not of a known type	remove	remove report omit	isg; gw	visual

jfif-extension-thumbnail-image

The image of the file and the thumbnail are not required to be of the same image. Data hiding is a risk if the encoded image and thumbnail differ. There may be thumbnail data in both JFIF and JFXX markers and applications may use either or neither of them. The extension thumbnail may reveal content not visible in the main image, or may be a different image entirely, resulting in inadvertent data disclosure.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
jfxx-thumbnail	gw-M379C48	Detect a thumbnail image embedded in the JFXX extension APP0 marker segment	remove	remove replace report omit	isg; gw	visual
jfxx-thumbnail-no-jfif-markers	gw-QVJ4K2A	Detect JFIF markers present within the JFXX extension thumbnail image	report	report omit	spec; isg; gw	structural

marker-segment-length

If the length specified is an invalid value (less than two or past the EOI) processing this marker segment is vulnerable to a data attack, possibly redirecting the processing application to an arbitrary address in memory resulting in a system crash or buffer overflow.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
marker-segment-length	gw-TF472H9	Detect a marker segment length that is out of range or extends past the EOI marker	reject	report omit	spec; isg; gw	structural

marker-values-and-order

An invalid marker indicates that the image file is malformed or corrupted and may indicate a data attack by causing the processing application to hang or crash.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
marker-order	gw-CXQ98NF	Detect JPEG markers appearing out of the spec-defined order	reject	report omit	spec; isg; gw	structural
stray-ff00-outside-segment	gw-GFWYRSY	Detect the hexadecimal value 0xFF00 appearing outside a marker segment or an entropy-coded segment	reject	report omit	spec; isg; gw	structural
stray-ffff-outside-segment	gw-5B8BMAT	Detect the hexadecimal value 0xFFFF appearing outside a marker segment	reject	report omit	spec; isg; gw	structural

nxpowerlite-app-marker

As with all APP markers there is potential for data hiding, data disclosure and data attack. The NXPowerLite APP marker currently only includes an integer; however, there is no guarantee that the software will not expand the field in the future.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
nxpl-identifier-null-terminated	gw-GX2FH62	Detect an NXPL APP marker identifier that is not zero terminated	report	report omit	spec; isg; gw	structural
nxpl-length	gw-PDYPBXG	Detect an NXPL APP marker whose length is not 8	report	report omit	spec; isg; gw	structural
nxpl-marker	gw-ZH4F77C	Detect an NXPowerLite (NXPL) APP marker segment present in the file	remove	remove report omit	isg; gw	functional
nxpl-position	gw-TW0GRJM	Detect an NXPL APP marker in an inappropriate position (before SOI, after EOI or as the first APP marker)	report	report omit	spec; isg; gw	structural
single-nxpl-marker	gw-FNGPFXF	Detect more than one NXPL APP marker present in the file	report	report omit	spec; isg; gw	structural

reserved-marker-segments

The presence of a reserved marker segment may indicate data hiding. Their structure has not been specified in ISO/IEC 10918-1 and they are reserved for future revisions.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
reserved-markers	gw-5T26D9F	Detect reserved marker segments (RES, JPG, JPGn) whose structure is unspecified	remove	remove report omit	isg; gw	structural

scan-header

A malformed scan header that may cause a JPEG decoder to crash and malicious code to run is considered a data attack.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
scan-component-count	gw-QGVMNKV	Detect a scan header Number of components parameter that disagrees with the count of component parameters present	reject	report omit	spec; isg; gw	structural
scan-header-spec	gw-ZX68W7B	Detect scan header (SOS) parameters that do not conform to the JPEG specification	reject	report omit	spec; isg; gw	structural
scan-header-well-formed	gw-RQ86VQG	Detect a scan header (SOS) with an out-of-range entropy-table selector or successive-approximation bit position; a component count (Ns) disagreeing with the frame's (Nf) for a single sequential scan; a component selector (Cs) or entropy-table selector (Td/Ta) that resolves to no defined frame component or Huffman table	reject	report omit	spec; isg; gw	structural

scans

Progressive processed frames contain multiple scans. The decoder may skip low-resolution scans and only display the high-resolution image. The presence of multiple scans is a data hiding risk. Converting to baseline does not sufficiently mitigate the issue since the selected scan could contain hidden data.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
progressive-multi-scan	gw-G2NR75A	Detect a progressive image with multiple scans that can be flattened to a single-scan baseline JFIF image	replace	replace report omit	isg; gw	visual
single-scan	gw-39E0PYX	Detect an image containing more than one scan	report	report omit	spec; isg; gw	structural

tables

Tables defined in a DQT, DHT or DAC segment but never referenced by a SOF or SOS segment are a data hiding risk.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
huffman-table-well-formed	gw-RWEBY34	Detect a Huffman table (DHT) with an out-of-range table class or destination selector, or whose code lengths overflow its marker segment	reject	report omit	spec; isg; gw	structural
quantization-table-well-formed	gw-757NHSY	Detect a quantization table (DQT) with an out-of-range element precision or destination selector, or whose definition overflows its marker segment	reject	report omit	spec; isg; gw	structural
unreferenced-tables	gw-GYJ2B1C	Detect table marker segments (DQT, DHT, DAC) that are never referenced by a SOF or SOS segment	remove	remove report omit	isg; gw	structural

JPEG 2000 (jpeg2000)

binary-filter-box

Contents of transformed data cannot be determined without decompressing or decrypting, posing data hiding and attack risks.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
binary-filter-box-present	gw-1GVB1CK	Detect a Binary Filter box present in the file	remove	remove report omit	isg; gw	structural
binary-filter-undecodable-invalid	gw-KPTW5DV	Detect Binary Filter box data that cannot be successfully decompressed or decrypted	report	report omit	spec; isg; gw	structural
binary-filter-uuid-invalid	gw-QQDM1RK	Detect a Binary Filter box whose UUID field is not one of the two specified values (GZIP or DES)	report	report omit	spec; isg; gw	structural

box-general

Self-reported box lengths enable data hiding and covert channels. Readers may ignore unknown boxes while retaining hidden data. Buffer overflow risk from unbounded lengths.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
box-identifier-invalid	gw-65M3SWR	Detect a box carrying an identifier that is not valid per the specification (Tables 5-2 and 5-3)	reject	remove report omit	spec; isg; gw	structural
box-length-exceeds-maximum	gw-A6FBVQ3	Detect a box, with no specification-defined length bound, whose length exceeds a predefined maximum length value	reject	remove report omit	spec; isg; gw	structural
box-length-out-of-range	gw-BFV17FZ	Detect a box whose length violates the bounds the specification defines for its box type (e.g. Signature 12 bytes, Image Header 22 bytes, Capture Resolution 18 bytes, Default Display Resolution 18 bytes, Composition Options 17 bytes), including data extending beyond that bound	reject	remove report omit	spec; isg; gw	structural
box-ordering-invalid	gw-CACTTGA	Detect boxes whose ordering violates the specification (Signature first, Filetype second, Reader Requirements third, JP2 Header before Codestream)	reject	report omit	spec; isg; gw	structural
box-unapproved-identifier-invalid	gw-D62Y0RX	Detect a box carrying an identifier that is not on the approved list of box identifiers	remove	remove report omit	isg; gw	structural

byte-aligned-segments

RBAS can hold arbitrary amounts of data (data hiding risk). Long sequence of BAS or overly extended RBAS could crash reader application (data attack risk).

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
bas-excess-invalid	gw-CGFR80X	Detect Byte Aligned Segments exceeding a predefined count threshold	remove	remove report omit	isg; gw	structural
bas-field-format-invalid	gw-EREHYB7	Detect a Byte Aligned Segment whose data does not adhere to the format for its specific field	report	report omit	spec; isg; gw	structural

data-entry-url-box

Data hiding from post-null-termination data and buffer overflow risks from unbounded URL strings.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
url-box-not-in-uuid-info	gw-ATQ29AD	Detect a Data Entry URL box that is not contained within a UUID Info box	report	report omit	spec; isg; gw	structural
url-box-present	gw-4B0E6KS	Detect a Data Entry URL box present in the file	remove	remove replace report omit	isg; gw	structural
url-post-null-data-present	gw-K80BG5D	Detect data following the null termination of the URL string	remove	remove report omit	isg; gw	structural
url-string-exceeds-maximum	gw-X6KD4GS	Detect a Data Entry URL box URL string that is longer than a predefined length	report	report omit	spec; isg; gw	structural
url-string-not-null-terminated	gw-2S3P2NH	Detect a Data Entry URL box URL string that is not null-terminated	report	report omit	spec; isg; gw	structural

digital-signature-box

Reader may not have key management support to validate signature. Data hiding risk from unvalidated signatures.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
digital-signature-box-present	gw-R8Q4C1Y	Detect a Digital Signature box present in the file	remove	remove report omit	isg; gw	structural
digital-signature-invalid	gw-XSGB37K	Detect a Digital Signature box whose checksum or signature is invalid or whose payload has been modified	report	report omit	spec; isg; gw	structural
digital-signature-unapproved-invalid	gw-K5T8ETD	Detect a Digital Signature box using a digital signature (rather than a checksum) that is not on the approved list	report	report omit	spec; isg; gw	structural

filetype-box

Self-reported length enables covert channels. The compatibility list data field has no bounded length, posing data hiding risks.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
filetype-brand-invalid	gw-M3KXBDG	Detect a Filetype box brand or compatibility list value outside the defined ISO-15444 set ('jp2\040', 'J2P0', 'J2P1')	replace	replace report omit	spec; isg; gw	structural

free-box

Free boxes are ignored by readers and pose a data hiding risk. Their contents are never displayed or processed.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
free-box-present	gw-HGDQ479	Detect Free boxes present in the file	remove	remove report omit	isg; gw	structural

icc-profile

Embedded ICC profile is an independent format that requires the same scrutiny for data hiding and attack risks as the JPEG 2000 file.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
icc-profile-nonconforming	gw-QVSHRC2	Detect an embedded ICC profile that does not conform to the ICC format specification	report	report omit	spec; isg; gw	structural
icc-profile-present	gw-7AMJF0M	Detect an ICC (International Color Consortium) profile embedded in the Color Specification box	remove	remove replace report omit	isg; gw	structural

image-data

Hidden data may be appended past the EOC (End of Codestream) marker, or carried in the least significant bits of the image samples that the format specification ignores.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
data-after-eoc-present	gw-ZFEVFCZ	Detect data following the EOC (End of Codestream) marker	remove	remove report omit	spec; isg; gw	structural
image-data-present	gw-N969SNC	Detect an image codestream whose sample data can carry an LSB-hidden payload (a capability, not proof of a payload); a lossy or structural re-encode destroys the channel—this is a generic disarm, not steganalysis	report	report replace omit	isg; gw	visual

jpsec-tools

Use of confidentiality tool makes validation impossible without decryption password. Authentication tool poses data attack via URI. Certificate data is an avenue for attack.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
jpsec-authentication-invalid	gw-N1D5W00	Detect a JPSEC Authentication Template (tool ID 2) whose data fails validation under the appropriate authentication method	report	report omit	spec; isg; gw	structural
jpsec-encrypted-data-invalid	gw-CZ3XERD	Detect a JPSEC Decryption Template (tool ID 1) indicating the data is encrypted	reject	remove report omit	spec; isg; gw	structural
jpsec-hash-mismatch-invalid	gw-CEGREJP	Detect a JPSEC tool (tool ID 3) whose recomputed hash does not match the stored hash for the specified data	report	report omit	spec; isg; gw	structural

marker-segments

Self-reported marker segment lengths enable data hiding. Array size values in marker segments may be manipulated to cause buffer overflows.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
marker-code-invalid	gw-XTQNRJ5	Detect a marker segment carrying a code that is not valid	report	report omit	spec; isg; gw	structural
marker-reserved-value	gw-ZJDFHXY	Detect a marker segment body carrying a reserved-enumeration or out-of-range field that changes the decode and cannot be safely normalized	reject	report omit	spec; isg; gw	structural
marker-reserved-bits	gw-E8P8S5F	Detect a marker segment body carrying reserved bits (a covert channel a conformant decoder ignores) that can be cleared in place	replace	report omit	spec; isg; gw	structural
marker-outside-codestream	gw-WFM5TS9	Detect a marker segment that lies outside the codestream data	report	report omit	spec; isg; gw	structural
marker-trailing-data-invalid	gw-DK50JWV	Detect a reserved marker code or a marker segment carrying data beyond its specification-defined length bound	remove	remove report omit	isg; gw	structural
comment-marker-present	gw-3TMWET7	Detect optional Comments (COM) marker segments	remove	remove replace report omit	isg; gw	structural
unmodelled-marker-present	gw-MK7Q2P4	Detect a codestream marker the engine does not model (a Part-2/15/17, JP3D, JPWL or otherwise-unrecognized extension marker, including CAP and PRF) whose body is copied through unvalidated	report	remove omit	isg; gw	structural
in-packet-delimiter-inconsistent	gw-P9X4RT2	Detect in-packet delimiter markers (SOP/EPH) inconsistent with the coding-style signaling or carrying a non-monotonic SOP sequence number (a covert channel)	report	omit	spec; isg; gw	structural

media-data-box

When data is not JPEG 2000 codestream, risks are the same as that data format and cannot be determined by the JPEG 2000 parser.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
media-data-noncodestream-invalid	gw-FAY8FQ6	Detect Media Data box content that is not a valid codestream when the Fragment Table box specifies codestream data	report	report omit	spec; isg; gw	structural
media-data-present	gw-8C8KQCJ	Detect a Media Data box present in the file	remove	remove report omit	isg; gw	structural

mpeg7-binary-box

Box may be ignored by readers that do not support Motion JPEG 2000, posing data hiding risk.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
mpeg7-box-present	gw-ZDV72YM	Detect an MPEG-7 Binary box present in the file	remove	remove report omit	isg; gw	structural

multiple-codestreams

No programmatic way to verify which codestream was intended for display. Additional codestreams may contain hidden data.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
jp2-multiple-codestreams-invalid	gw-2W3SXSA	Detect JP2-formatted data carrying more than one codestream box	remove	remove report omit	spec; isg; gw	structural

multiple-jpx-codestreams

Each codestream in a JPX file is susceptible to the same data hiding and attack risks as individual codestreams (JPEG2000:8 through JPEG2000:11). See Section 5.3 recommendations.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
jpx-per-codestream-risks-invalid	gw-YX8FBFJ	Detect a JPX file whose individual codestreams carry the same single-codestream risks (image data integrity, codestream count, resolution levels and steganography)	report	report omit	spec; isg; gw	structural

reader-requirements-box

Variable length Vendor Features list containing UUIDs may not be validated by readers, posing data hiding risk.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
vendor-features-present	gw-XV2AJGZ	Detect Vendor Features information present in the Reader Requirements box	remove	remove report omit	isg; gw	structural

resolution-levels

Progressive resolution capability poses data disclosure risk. Sensitive data may be revealed at certain resolution levels that are not visible at the default display resolution.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
decomposition-levels-invalid	gw-F5CBETG	Detect a codestream declaring more decomposition levels than the re-encode target, so higher-resolution detail can be removed or degraded by re-encoding	report	report replace omit	spec; isg; gw	visual

signature-box

Invalid signature values indicate non-valid JP2-formatted data. The Signature box is a fixed 12-byte box that must appear first.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
signature-error-check-invalid	gw-70YG6V7	Detect a Signature box whose error-check field is not 0x0D0A870A (not applicable when data is JPC formatted)	reject	report omit	spec; isg; gw	structural

uuid-box

The UUID box data field has no bounds or format defined by the specification, posing data hiding and buffer overflow risks.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
uuid-box-present	gw-F3XESNT	Detect a UUID box present in the file (its unbounded, format-undefined data field poses a data-hiding risk)	remove	remove report omit	isg; gw	structural

xml-extended-metadata-box

XML schemas are loose and support input flexibility, posing data hiding and attack risks from malformed or oversized XML.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
xml-box-present	gw-N76PVYR	Detect XML boxes present in the file	remove	remove report omit	isg; gw	structural
xml-box-schema-invalid	gw-G9YJBG1	Detect XML extended metadata box data that does not validate against its corresponding schema	report	report replace omit	spec; isg; gw	structural

EMF (emf)

bitmap-records

Bitmap records embed DIB (Device Independent Bitmap) data with offsets and sizes that must be validated against the record boundary. Invalid BITMAPINFOHEADER fields (biWidth, biHeight, biBitCount, biSizeImage) can cause heap overflows. Unknown biCompression values may trigger codec vulnerabilities. Source rectangles outside the bitmap dimensions cause out-of-bounds reads. MaskBlt and PlgBlt records have additional bitmap payloads that multiply the attack surface. Embedded JPEG/PNG data must be passed to the appropriate sub-camera.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
bitmap-records-bounds	gw-YXAJ91A	Detect bitmap record offsets or sizes that fall outside bounds	report	report omit	spec; gw	structural
bitmap-records-compression-value	gw-QR9PQCV	Detect a biCompression value outside the known set (BI_RGB, BI_RLE8, BI_RLE4, BI_BITFIELDS, BI_JPEG, BI_PNG)	report	report omit	spec; gw	structural
bitmap-records-dib-header-size	gw-WRQVVJS	Detect a DIB header size outside the known set (40 for BITMAPINFOHEADER, 108 for V4, 124 for V5)	report	report omit	spec; gw	structural
bitmap-records-embedded-image-present	gw-JCNECCS	Detect embedded raster image data (DIB, JPEG or PNG) carried in a bitmap record	report	report omit	gw	structural

clipping-records

Clipping records define regions that restrict rendering output. Invalid rectangle coordinates can cause integer overflow in region calculations. EMR_EXTSELECTCLIPRGN contains variable-length region data whose size must match the record. Unknown region mode values cause undefined clipping behavior.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
clipping-records-combine-mode-values	gw-HHZ0PHX	Detect a region combining mode outside the known set (RGN_AND=1, RGN_OR=2, RGN_XOR=3, RGN_DIFF=4, RGN_COPY=5)	report	report omit	spec; gw	structural
clipping-records-region-size-overflow	gw-1D0K8BB	Detect a region data size that exceeds the record boundary	reject	report omit	spec; gw	structural

color-management

Color management records can embed ICC profiles (large binary blobs with known parser vulnerabilities), reference external profile file paths (path traversal attacks) and configure ICM processing modes. Profile paths may disclose file system layout. ICC profile data must be size-validated and passed to a specialized handler. Color match to target can reference external files.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
color-management-color-match-target	gw-4GQGWZ2	Detect EMR_COLORMATCHTOTARGET records that reference external target profiles	remove	remove report omit	gw	functional
color-management-external-paths	gw-DXVQX5Q	Detect external ICC profile file path references	reject	report omit	spec; gw	functional
color-management-icc-data-embedded	gw-62FG7VC	Detect embedded ICC profile data that requires content validation by an external ICC profile handler	report	report omit	gw	structural
color-management-icc-size-overflow	gw-TADPC50	Detect an embedded ICC profile size that exceeds the record boundary	reject	report omit	spec; gw	structural
color-management-icm-mode	gw-THDC56V	Detect an ICM mode enabling color management processing	replace	replace report omit	gw	functional
color-management-logcolorspace-values	gw-NETK0ZR	Detect a LOGCOLORSPACE colorspace type or intent outside the known set	report	report omit	spec; gw	structural
color-management-profile-paths	gw-E2W6WWT	Detect file path references in EMR_SETICMPROFILEA and EMR_SETICMPROFILEW records	remove	remove report omit	gw	functional
color-management-structure	gw-RF27NV8	Detect color management records whose structure is malformed	report	report omit	spec; gw	structural

comment-records

EMF comment records are the primary vector for embedded content and data hiding. EMR_COMMENT_EMFPLUS embeds GDI+ instructions that constitute a second instruction stream. EMR_COMMENT_EMFSPOOL contains printer spool commands that may run with elevated privileges. Generic comments can hide arbitrary data. EMR_COMMENT_MULTIFORMATS can embed WMF, EMF or other format data. Unbalanced EMF+ groups cause resource leaks. The data size field must be validated against the record boundary.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
comment-records-data-size-within-record	gw-PB0BVMG	Detect a comment data size (cbData) that is inconsistent with the record size (nSize - 12)	report	report omit	spec; gw	structural
comment-records-embedded-content-present	gw-NCPARA4	Detect embedded EMF+ or WMF content carried in a comment record	report	report omit	gw	functional
comment-records-emfplus-nested-sizes	gw-W6VWJPN	Detect EMF+ record sizes within comment data that are inconsistent or exceed the comment boundary	report	report omit	spec; gw	structural
comment-records-emfspool	gw-8KYVF1F	Detect EMR_COMMENT_EMFSPOOL records carrying printer spool commands	remove	remove report omit	gw	functional
comment-records-generic	gw-WP5DZF8	Detect generic EMR_COMMENT records that match no known public comment identifier	remove	remove report omit	gw	functional
comment-records-group-bracket-balance	gw-VVCJZNS	Detect unbalanced GDICOMMENT_BEGINGROUP and GDICOMMENT_ENDGROUP records	report	report omit	spec; gw	structural
comment-records-group-description	gw-5C7X3ZE	Detect a GDICOMMENT_BEGINGROUP description string carrying arbitrary content	replace	replace report omit	gw	visual
comment-records-group-unicode	gw-8TCM8EX	Detect Unicode string data in a GDICOMMENT_BEGINGROUP description	remove	remove report omit	gw	visual
comment-records-public-identifier-values	gw-FTHVS7Z	Detect an EMR_COMMENT_PUBLIC identifier outside the known set (GDICOMMENT_BEGINGROUP, GDICOMMENT_ENDGROUP, GDICOMMENT_MULTIFORMATS, GDICOMMENT_WINDOWS_METAFILE, GDICOMMENT_IDENTIFIER)	report	report omit	spec; gw	structural
comment-records-structure	gw-6N43FB8	Detect comment records whose structure or content bounds are malformed	report	report omit	spec; gw	structural
comment-records-unknown-identifiers	gw-PE12CQX	Detect comment records with unknown identifiers	reject	report omit	spec; gw	structural

control-records

EMR_EOF marks the end of the metafile. Missing EOF records cause parsers to read beyond valid data. Multiple EOF records can hide content between them. The SizeLast field enables reverse traversal; an incorrect value can mislead backwards-walking parsers. Palette data in the EOF record must be validated.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
control-records-eof-validation	gw-WVPY6JV	Detect a missing EMR_EOF record at the end of the file	report	report omit	spec; gw	structural
control-records-single-eof	gw-AATWFC6	Detect more than one EMR_EOF record	reject	report omit	spec; gw	structural
control-records-sizelast	gw-WWT4G6G	Detect a SizeLast field that no longer matches the EMR_EOF record nSize after remediation	replace	replace report omit	gw	structural

dc-save-restore

EMR_SAVEDC pushes device context state onto a stack; EMR_RESTOREDC pops it. Unbalanced operations cause stack underflow (crash) or resource exhaustion (DoS via deep stack). The nRelSaveDC parameter in RestoreDC specifies how many levels to pop; negative values relative to current depth must be validated.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
dc-save-restore-stack-underflow	gw-ND0EVT5	Detect an EMR_RESTOREDC that would underflow the device context stack	reject	report omit	spec; gw	structural

drawing-records

Drawing records contain variable-length point arrays. Integer overflow in point count multiplication (count * sizeof(POINT)) can cause heap buffer overflows. PolyPolygon records have nested counts that must sum correctly. Extreme coordinate values can trigger integer overflow in rendering pipelines. Unknown vertex types in PolyDraw records cause undefined behavior.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
drawing-records-point-count-consistency	gw-TGMWVPP	Detect point counts in polygon/polyline records that are inconsistent with the record size	report	report omit	spec; gw	structural
drawing-records-point-count-maximum	gw-A2PCC19	Detect point counts that exceed a safe maximum for memory allocation	reject	report omit	spec; gw	structural
drawing-records-point-counts	gw-GNAA5P4	Detect malformed point array counts in drawing records	report	report omit	spec; gw	structural
drawing-records-polydraw-vertex-types	gw-9BRNJM6	Detect PolyDraw vertex type bytes outside the known set (PT_LINETO, PT_BEZIERTO, PT_MOVETO, PT_CLOSEFIGURE)	reject	report omit	spec; gw	structural

emf-header

The EMR_HEADER defines the entire metafile's coordinate space, object table size and embedded description. Malformed signatures bypass format detection. Invalid bounds or frame rectangles can cause integer overflows in rendering. Zero device dimensions cause division-by-zero in coordinate transforms. The description string offset/length may read beyond the record. Reserved fields may hide data.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
emf-header-bounds	gw-ZMY4P8V	Detect an inconsistent EMF header bounding box	reject	report omit	spec; gw	structural
emf-header-description-bounds	gw-ZN2R964	Detect an EMF header description string that falls outside its bounds	report	report omit	spec; gw	visual
emf-header-handle-count-nonzero	gw-9CA8C3K	Detect a handle count that is zero or outside a reasonable range	report	report omit	spec; gw	structural
emf-header-record-count	gw-1J3YAHX	Detect an EMF header record count that does not match the actual record count	report	report omit	spec; gw	structural
emf-header-record-count-nonzero	gw-63W1NDG	Detect a declared record count that is zero or exceeds file size divided by minimum record size	report	report omit	spec; gw	structural
emf-header-record-type	gw-4YJ7BWG	Detect a first record type that is not EMR_HEADER (0x00000001)	report	report omit	spec; gw	structural
emf-header-rectangles-valid	gw-AM0QY5K	Detect a degenerate header bounding box or frame rectangle (right<left or bottom<top, excluding the empty-rectangle sentinel)	report	report omit	spec; gw	structural
emf-header-reserved-field	gw-C2J4RW1	Detect a non-zero reserved field in the EMR_HEADER	replace	replace report omit	gw	structural
emf-header-signature	gw-PRSC5J8	Detect an EMF header signature that is not the expected value	reject	report omit	spec; gw	structural
emf-header-size	gw-CW9XYNG	Detect an inconsistent EMF header record size	report	report omit	spec; gw	structural
emf-header-size-range	gw-HWM3GTT	Detect a header record size (nSize) below 88 bytes or exceeding nBytes	report	report omit	spec; gw	structural
emf-header-version	gw-AC0XHXM	Detect an EMF header version that is not 0x00010000	reject	report omit	spec; gw	structural

emfplus-records

EMF+ records embed a second, parallel instruction stream inside EMR_COMMENT_EMFPLUS envelopes. Individual record types carry inner-field lengths (StringLength, Count, SubregionCount) whose declared value can exceed the record DataSize, producing the same 'header smaller than payload' memory-corruption shape as the outer EMF layer. Windows GDI+ has been exploited through EmfPlusDrawString string-length corruption (CVE-2021-1665), EmfPlusFillRects / EmfPlusSetTSClip rectangle-count mismatch (CVE-2025-30388) and EmfPlusDrawRects bitmap-scan overflow (CVE-2025-53766). EmfPlusComment records (MS-EMFPLUS §2.3.2.1) are the main place a steganography tool can hide a payload, as proof-of-concept tooling has shown. The record-structure rules catch gross boundary violations in the outer EMF record headers; the four bounds rules below check the inner fields of individual EMF+ records, and emfplus-records-comment-present flags EmfPlusComment payloads that remain when the operator has turned off their removal.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
emfplus-records-comment-present	gw-T8GNHA9	Detect an EmfPlusComment record (type 0x4003) with non-empty Data, a location for arbitrary operator-defined steganography payload bytes	report	report omit	spec; gw	functional
emfplus-records-drawrects-bounds	gw-XPHRC8Y	Detect an EmfPlusDrawRects record (type 0x400B) where Count * 16 + 8 exceeds DataSize, an undersized RectData array relative to the declared Count	reject	report omit	spec; cve; gw	structural
emfplus-records-drawstring-bounds	gw-3058EXV	Detect an EmfPlusDrawString record (type 0x401C) where StringLength * 2 + 28 exceeds DataSize, a declared string length beyond the available payload	reject	report omit	spec; cve; gw	structural
emfplus-records-fillrects-bounds	gw-HJ83H5C	Detect an EmfPlusFillRects record (type 0x400A) where Count * 16 + 8 exceeds DataSize, an undersized RectData array relative to the declared Count	reject	report omit	spec; cve; gw	structural
emfplus-records-settsclip-bounds	gw-5KTMHVM	Detect an EmfPlusSetTSClip record (type 0x403A) where the Count field (Flags low 13 bits) times the per-rectangle size (16 bytes, or 8 when Flags bit 15 is set) exceeds DataSize	reject	report omit	spec; cve; gw	structural
emfplus-records-stream-embedded	gw-AXAVXKC	Detect a preserved EMF+ record stream that requires downstream semantic validation	report	report omit	gw	functional

escape-records

Escape records pass arbitrary data directly to device drivers, bypassing GDI rendering. EMR_DRAWESCAPE and EMR_EXTESCAPE can inject PostScript commands (CVE-style attacks). Named escapes reference driver-specific features. These records are the most dangerous attack vector in EMF files and should be removed or rejected in high-security environments.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
escape-records-data	gw-VY6C67X	Detect escape data payload carried in escape records	remove	remove report omit	gw	functional
escape-records-data-size-within-record	gw-80W79RC	Detect an escape data size that is inconsistent with the record size	report	report omit	spec; gw	structural
escape-records-draw	gw-VCN7T7D	Detect EMR_DRAWESCAPE records	remove	remove report omit	cve; gw	functional
escape-records-ext	gw-5PWVXBY	Detect EMR_EXTESCAPE records	remove	remove report omit	gw	functional
escape-records-function-code-values	gw-CMC46PD	Detect an escape function code (iEscape) outside the known set	report	report omit	spec; gw	functional
escape-records-named	gw-9TM3WJ2	Detect EMR_NAMEDESCAPE records	remove	remove report omit	gw	functional
escape-records-postscript	gw-BMNWEYZ	Detect PostScript escape codes (POSTSCRIPT_DATA, POSTSCRIPT_PASSTHROUGH, ENCAPSULATED_POSTSCRIPT)	reject	report omit	gw	functional
escape-records-record-count	gw-V043DJZ	Detect a header record count that no longer matches the record chain after escape record removal	replace	replace report omit	gw	structural
escape-records-structure	gw-N3D55AH	Detect escape records whose structure is malformed	report	report omit	spec; gw	functional

file-structure

Malformed file sizes can trigger buffer overflows or out-of-bounds reads in parsers. Oversized declarations may cause excessive memory allocation (DoS). Files smaller than the minimum EMF header size cannot be valid. Bytes after the EMR_EOF record are not rendered and are an ideal location for data hiding (embedded executables, steganographic content or an alternate appended file format).

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
file-structure-declared-exceeds-actual	gw-MKDTPMY	Detect a declared size that exceeds the actual file size, indicating a truncated or corrupted file	reject	report omit	spec; gw	structural
file-structure-declared-size	gw-BYQCP09	Detect a declared file size (nBytes in EMR_HEADER) that does not match the actual file size	report	report omit	spec; gw	structural
file-structure-integrity	gw-60ADQXP	Detect a malformed EMF file structure across the record chain, sizes and offsets	reject	report omit	spec; gw	structural
file-structure-minimum-size	gw-X1K4DH4	Detect an actual file size below the minimum EMF size (88 bytes for the header record)	reject	report omit	spec; gw	structural
trailing-data	gw-XG1XNQT	Detect bytes following the EMR_EOF record	remove	remove report omit	gw	structural

font-embedding

Font embedding records reference Universal Font Identifiers (UFIs) and design vectors for font matching. Variable-length UFI arrays and design vector data can overflow record boundaries. Linked UFIs reference external font resources. Force UFI mapping can bypass normal font substitution, potentially loading malicious fonts.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
font-embedding-force-ufi-mapping	gw-0EWSQ6W	Detect EMR_FORCEUFIMAPPING records that bypass normal font substitution	remove	remove report omit	gw	functional
font-embedding-linked-ufis	gw-WA2R2VJ	Detect linked UFI references that point to external font resources	remove	remove report omit	gw	functional
font-embedding-size-overflow	gw-GFEE1CY	Detect a UFI count or design vector data that exceeds the record boundary	reject	report omit	spec; gw	structural
font-embedding-structure	gw-M76MQHX	Detect font embedding records whose structure is malformed	report	report omit	spec; gw	functional

object-creation

EMF maintains an object handle table sized by nHandles in the header. Out-of-range handle indices cause array overflows. Selecting or deleting unoccupied handles indicates corruption or attack. Extended pen styles with custom dash patterns have variable-length arrays. Font face names can contain path traversal or null-injection attacks. Brush styles may reference embedded DIB data.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
object-creation-bounds	gw-HACAJSC	Detect object creation record offsets, sizes or handle limits that fall outside bounds	report	report omit	spec; gw	structural
object-creation-brush-style-values	gw-2ZSJTYN	Detect a brush style value outside the known set (BS_SOLID, BS_NULL, BS_HATCHED, BS_PATTERN, BS_DIBPATTERN, BS_DIBPATTERNPT)	report	report omit	spec; gw	structural
object-creation-handle-occupied	gw-G47ZJGD	Detect an EMR_SELECTOBJECT that references an empty handle slot that is not a stock object	report	report omit	spec; gw	structural
object-creation-index-range	gw-2F2KDKS	Detect an object handle index outside the range [0, nHandles-1]	reject	report omit	spec; gw	structural
object-creation-pen-style-entry-count	gw-7A44FQQ	Detect a custom dash pattern entry that is zero or an array count that is inconsistent with the record size	report	report omit	spec; gw	structural
object-creation-pen-style-values	gw-QMFQ354	Detect a pen style value outside the known set (PS_SOLID, PS_DASH, PS_DOT, PS_DASHDOT, PS_DASHDOTDOT, PS_NULL, PS_INSIDEFRAME, PS_USERSTYLE, PS_ALTERNATE)	report	report omit	spec; gw	structural

opengl-records

OpenGL records embed GLS (Graphics Library Stream) command data that is passed directly to the OpenGL driver. These records can run arbitrary GPU commands and are extremely dangerous. The bOpenGL flag in the header extension indicates OpenGL content presence. GLS data sizes must be validated. These records should be removed in security-conscious environments.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
opengl-records	gw-NZQ93Z5	Detect EMR_GLSRECORD or EMR_GLSBOUNDEDRECORD records	reject	report omit	gw	functional
opengl-records-bopengl	gw-5AWYS9Z	Detect a bOpenGL flag set in the EMR_HEADER extension	replace	replace report omit	gw	functional
opengl-records-data-size-within-record	gw-807THD6	Detect a GLS data size (cbData) that is inconsistent with the record size	report	report omit	spec; gw	structural
opengl-records-gls	gw-EXQEG4H	Detect EMR_GLSRECORD records carrying GLS command streams	remove	remove report omit	gw	functional
opengl-records-gls-bounded	gw-D3HK0EV	Detect EMR_GLSBOUNDEDRECORD records carrying bounded GLS data with rendering bounds	remove	remove report omit	gw	functional
opengl-records-structure	gw-1ZYS9DZ	Detect OpenGL records whose presence or structure is malformed	report	report omit	spec; gw	functional

palette-records

Palette records contain variable-length entry arrays. Integer overflow in entry count multiplication can cause heap buffer overflows. The LOGPALETTE version must be 0x0300. Palette entry flags must be known values. ResizePalette can expand the palette beyond reasonable limits, causing excessive memory allocation.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
palette-records-entry-count-consistency	gw-8Y2KA66	Detect a palette entry count that is inconsistent with the record size (cEntries * 4 exceeds available data)	report	report omit	spec; gw	structural
palette-records-resize-maximum-count	gw-M4NKQST	Detect an EMR_RESIZEPALETTE entry count that exceeds the safe maximum (65536)	report	report omit	spec; gw	structural
palette-records-structure	gw-WAGHMK9	Detect palette records whose structure is malformed	report	report omit	spec; gw	structural
palette-records-version-and-flags	gw-TC0BVJ8	Detect a LOGPALETTE version that is not 0x0300 or a palette entry flag outside the known set (0, PC_EXPLICIT, PC_NOCOLLAPSE, PC_RESERVED)	report	report omit	spec; gw	structural

path-records

Path brackets (BeginPath/EndPath) define GDI path construction regions. Unbalanced brackets can cause resource leaks or undefined state in renderers. Path control records (CloseFigure, FlattenPath, etc.) have fixed sizes; excess bytes may hide data.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
path-records-exact-size	gw-VEWNTD8	Detect a path control record (BeginPath, EndPath, CloseFigure, FlattenPath, WidenPath, AbortPath) whose size is not the fixed 8 bytes	report	report omit	spec; gw	structural
path-records-padding	gw-DZVCMJC	Detect padding bytes beyond the expected 8-byte size in path control records	replace	replace report omit	gw	structural

pixel-format

Pixel format records configure OpenGL rendering surface properties. The PIXELFORMATDESCRIPTOR contains flags that enable hardware acceleration and overlay planes. Invalid nSize values can cause buffer overreads. These records are only meaningful for OpenGL-enabled metafiles and should be removed when OpenGL records are stripped.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
pixel-format-descriptor-exact-size	gw-MFJE1R1	Detect a PIXELFORMATDESCRIPTOR nSize that is not the expected 40 bytes	report	report omit	spec; gw	structural
pixel-format-descriptor-size-within-record	gw-KX60V7F	Detect PIXELFORMATDESCRIPTOR data that does not fit within the record boundary	report	report omit	spec; gw	structural
pixel-format-flags-values	gw-5HRH82X	Detect pixel format flags, type or layer type outside the known set	report	report omit	spec; gw	functional
pixel-format-setpixelformat	gw-JZASEAB	Detect EMR_SETPIXELFORMAT records	remove	remove report omit	gw	functional
pixel-format-structure	gw-6VSSRCA	Detect pixel format records whose structure is malformed	report	report omit	spec; gw	functional

post-cdr-validation

Remediation may produce a structurally invalid EMF that fails to render.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
post-cdr-validation-round-trip	gw-TVKJRGP	Detect a post-CDR output file that does not re-parse as a valid EMF with EMR_HEADER first and EMR_EOF last	report	report omit	gw	structural

record-structure

Each EMF record begins with a type and size. Undersized records cause buffer under-reads. Non-aligned sizes break sequential parsing. Mismatched record counts indicate hidden or missing records. Unknown record types may trigger undefined behavior in renderers. Cyclical size references can cause infinite loops.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
record-extends-beyond-file	gw-NM70VFR	Detect a record whose declared offset and size extend beyond the end of the file	reject	report omit	spec; gw	structural
record-structure-alignment	gw-K24WEXR	Detect a record size that is not DWORD-aligned (not a multiple of 4)	report	report omit	spec; gw	structural
record-structure-minimum-size	gw-FK3PPSP	Detect a record size below 8 bytes (the minimum for iType + nSize)	report	report omit	spec; gw	structural
record-structure-minimum-size-per-type	gw-89NZX53	Detect a record smaller than the minimum size for its type	reject	report omit	spec; gw	structural
record-structure-padding	gw-J6ACZYR	Detect padding bytes within DWORD-aligned record sizes	replace	replace report omit	gw	structural
record-structure-unknown-types	gw-99GKXR5	Detect unknown or undefined record types	reject	report omit	spec; gw	structural
record-structure-validation	gw-5EEYH6F	Detect a malformed internal record structure (type, size, data alignment)	reject	report omit	spec; gw	structural

state-records

State records configure the device context rendering parameters. Invalid map mode values cause undefined coordinate transforms. Unknown enum values in SetBkMode, SetPolyFillMode, SetROP2, SetStretchBltMode and SetTextAlign can trigger undefined behavior. Records larger than the minimum required size may contain hidden data in padding bytes. Extreme miter limit values can cause rendering anomalies.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
state-records-enum-values	gw-HR0G5QD	Detect an enum value in SetBkMode, SetPolyFillMode, SetROP2, SetStretchBltMode or SetTextAlign outside the known set	report	report omit	spec; gw	structural
state-records-exact-size	gw-PZYXTD7	Detect a state record size that does not match the expected size for its record type (typically 12 bytes)	report	report omit	spec; gw	structural
state-records-map-mode	gw-4E0NKHJ	Detect an unknown map mode or enum value in state records	reject	report omit	spec; gw	structural
state-records-padding	gw-RKRRSXT	Detect padding bytes in state records beyond their expected minimum size	replace	replace report omit	gw	structural

text-records

Text records contain variable-length strings with offsets that must fall within the record boundary. The inter-character spacing (Dx) array size must match the character count. Integer overflow in offset + length calculations can cause out-of-bounds reads. SmallTextOut has a compact encoding with different validation requirements. Text content itself may contain sensitive information.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
text-records-char-count-consistency	gw-BWGDKC2	Detect a character count that is inconsistent with the available record data size	report	report omit	spec; gw	structural
text-records-content-embedded	gw-2SQ5ZPT	Detect embedded text content that requires content inspection by an external text handler	report	report omit	gw	visual
text-records-options-flags	gw-GXK0HJV	Detect text output option flags outside the known set (ETO_OPAQUE, ETO_CLIPPED, ETO_GLYPH_INDEX, ETO_RTLREADING, ETO_PDY)	report	report omit	spec; gw	structural

transform-records

World transform matrices control all coordinate mapping. NaN or Infinity values in matrix elements cause undefined rendering behavior and may crash renderers. A zero determinant (eM11*eM22 - eM12*eM21 = 0) makes the transform non-invertible, causing failures in hit-testing and reverse transforms. Zero extent transforms collapse all output to a single point.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
transform-records-nan-identity	gw-QQYXVER	Detect NaN or Infinity values in transform matrix elements	report	report omit	gw	structural

WMF (wmf)

bitmap-records

Bitmap records are the second-highest risk category in WMF. Buffer overflow exploits (CVE-2005-2123, CVE-2005-2124, CVE-2008-3015) exploit inconsistencies between record size and bitmap parameters. Integer overflow in size calculations can be triggered by negative or zero dimensions, or non-standard bit depths. Out-of-bounds reads occur when declared biSizeImage exceeds actual pixel data (CVE-2017-0190). Source-dependent raster operations with no embedded bitmap cause null pointer dereference.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
bitmap-dib-compression	gw-R6VDAQK	Detect a biCompression value that is not a known DIB compression (BI_RGB=0, BI_RLE8=1, BI_RLE4=2, BI_BITFIELDS=3)	report	report omit	spec; gw	structural
bitmap-dib-dimensions	gw-N3A66T9	Detect DIB header fields outside valid ranges (biWidth <= 0, biHeight == 0 or biBitCount not in {1, 4, 8, 16, 24, 32})	report	report omit	spec; gw	structural
bitmap-dib-size-image	gw-Y5F1SS5	Detect a biSizeImage inconsistent with biWidth * biHeight * (biBitCount/8) accounting for row padding	report	report omit	spec; cve; gw	structural
bitmap-embedded-dib	gw-EJ5EWPK	Detect an embedded DIB bitmap that requires deep inspection by an image data handler	report	report omit	gw	structural
bitmap-raster-op-source	gw-39XMF0Y	Detect a RasterOperation that references a source when no bitmap is present in the record	report	report omit	spec; gw	structural
bitmap-record-size-consistency	gw-D9FPV4D	Detect a RecordSize inconsistent with the declared bitmap dimensions, bit depth and compression	report	report omit	spec; gw	structural
bitmap-source-rect-bounds	gw-WKFF2N4	Detect source coordinates (XSrc, YSrc, SrcWidth, SrcHeight) that exceed the DIB dimensions	report	report omit	spec; gw	structural

device-context

Zero extent values cause division by zero in coordinate transforms. Restoring a non-existent DC level causes stack underflow. Unknown mapping modes cause undefined coordinate transform behavior.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
dc-map-mode	gw-KRV7DSS	Detect a META_SETMAPMODE with a mode that is not a known value from the MapMode enumeration	report	report omit	spec; gw	structural
dc-save-restore-balance	gw-6528Z1X	Detect a META_RESTOREDC referencing a saved DC level that does not exist (unbalanced SAVEDC/RESTOREDC)	report	report omit	spec; gw	structural
dc-viewport-extent	gw-508AXG9	Detect a META_SETVIEWPORTEXT with a zero width or height	report	report omit	spec; gw	structural
dc-window-extent	gw-2MGDNWH	Detect a META_SETWINDOWEXT with a zero width or height	report	report omit	spec; gw	structural

escape-records

META_ESCAPE is the highest-risk record type in the WMF format. The infamous CVE-2005-4560 (SETABORTPROC) exploit used META_ESCAPE to achieve arbitrary code execution on all Windows versions. META_ESCAPE provides access to 50+ escape functions, many of which are printer-specific, capable of embedding arbitrary data or running arbitrary code. PostScript escapes inject arbitrary PostScript code. Passthrough escapes send raw data directly to the printer driver. Channel escapes open direct communication channels. MFCOMMENT embeds arbitrary binary data including full EMF files.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
escape-records-mfcomment	gw-E6WSFDQ	Detect a META_ESCAPE record with EscapeFunction = MFCOMMENT (0x000F), which embeds arbitrary binary data as a comment (used to embed a full EMF file inside a WMF via META_ESCAPE_ENHANCED_METAFILE)	remove	remove report omit	gw	functional
escape-records-postscript	gw-VMFW9F7	Detect a META_ESCAPE record with a PostScript EscapeFunction: POSTSCRIPT_DATA (0x0025), POSTSCRIPT_PASSTHROUGH (0x1013), POSTSCRIPT_IDENTIFY (0x1005), POSTSCRIPT_INJECTION (0x1006) or ENCAPSULATED_POSTSCRIPT (0x1014)	reject	report omit	spec; gw	functional
escape-records-present	gw-WPSAE8P	Detect any META_ESCAPE record	remove	remove report omit	gw; advisory	functional
escape-records-setabortproc	gw-Q9WR00P	Detect a META_ESCAPE record with EscapeFunction = SETABORTPROC (0x0009)	reject	report omit	spec; cve; gw	functional
escape-records-whitelist	gw-9N259FV	Detect a META_ESCAPE record whose escape function code is outside the approved whitelist (currently empty: there is no known safe subset of GDI escape functions for document processing, so all escape functions including PASSTHROUGH, SPCLPASSTHROUGH2, OPEN_CHANNEL, CLOSE_CHANNEL and DOWNLOAD_HEADER are detected)	reject	report omit	spec; gw	functional

font-records

Unknown character sets may trigger undefined font mapper behavior. Non-terminated face names cause buffer over-read in font lookup. Extreme font dimensions can cause integer overflow in glyph rendering.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
font-char-set	gw-F0MZST3	Detect a CharSet that is not a known value from the CharacterSet enumeration	report	report omit	spec; gw	structural
font-dimension-bounds	gw-9M6P2TA	Detect lfHeight or lfWidth outside reasonable bounds	report	report omit	spec; gw	structural
font-face-name-disclosure	gw-WW5J3CM	Detect a FaceName that may disclose sensitive information	report	report omit	spec; gw	visual
font-face-name-termination	gw-Q63APBE	Detect a FaceName that is not null-terminated within 32 bytes	report	report omit	spec; gw	structural

meta-header

Data attack risks exist if the file type, version or size fields are malformed. Size mismatch is a common indicator of appended data or truncation; exploits often set invalid sizes to confuse parsers (CVE-2007-1211). Oversized object tables can trigger excessive memory allocation. The NumberOfMembers field is unused and non-zero values may hide data.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
meta-header-file-size	gw-8P5G6WE	Detect SizeLow/SizeHigh (total file size in WORDs) that disagrees with the actual file length	report	report omit	spec; gw	structural
meta-header-gap-data	gw-5WXX0AR	Detect data between the end of the placeable header (if present) and the start of META_HEADER	report	report omit	spec; gw	structural
meta-header-invalid-type	gw-WMFT8RJ	Detect a META_HEADER Type field that is not 0x0001 (memory) or 0x0002 (disk)	reject	report omit	spec; gw	structural
meta-header-invalid-version	gw-WMFV9PK	Detect a META_HEADER Version field that is not 0x0100 or 0x0300	reject	report omit	spec; gw	structural
meta-header-max-record	gw-FNK26NK	Detect a MaxRecord value that exceeds the file size	report	report omit	spec; gw	structural
meta-header-number-of-members	gw-Q06Z4KC	Detect a non-zero NumberOfMembers field (unused per MS-WMF; non-zero values may hide data)	replace	replace report omit	gw	structural
meta-header-number-of-objects	gw-A0Q1W9A	Detect a NumberOfObjects that is unreasonable (e.g., > 65535) or inconsistent with the actual object creation records in the stream	report	report omit	spec; gw	structural

object-table

Out-of-range object indices cause use of uninitialized memory or out-of-bounds table access. Double-free or deletion of non-existent objects causes heap corruption. Exceeding the object table causes heap overflow. Leaked objects may indicate incomplete record streams designed to exhaust resources.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
object-delete-index-valid	gw-VXVMFX2	Detect a META_DELETEOBJECT index outside the range [0, NumberOfObjects) or referencing an unoccupied slot	report	report omit	spec; gw	structural
object-lifecycle-complete	gw-PE3XQZV	Detect created objects that are never deleted (leaked objects)	report	report omit	spec; gw	structural
object-select-index-range	gw-9VHXCN6	Detect a META_SELECTOBJECT index outside the range [0, NumberOfObjects)	report	report omit	spec; gw	structural
object-table-overflow	gw-X2N72YY	Detect objects created beyond the declared NumberOfObjects limit	report	report omit	spec; gw	structural

palette-records

Mismatch between NumberOfEntries and RecordSize causes buffer overflow when reading palette entries. Unknown palette entry flags may trigger undefined behavior. Excessive palette sizes can exhaust memory.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
palette-entry-count-consistency	gw-9Q8B8VR	Detect a META_CREATEPALETTE whose NumberOfEntries is inconsistent with RecordSize	report	report omit	spec; gw	structural
palette-entry-flags	gw-T7WN4CY	Detect a palette entry PaletteEntryFlag value that is not a known flag (0x00, 0x01, 0x02, 0x04)	report	report omit	spec; gw	structural
palette-resize-bounds	gw-9YV4QXG	Detect a META_RESIZEPALETTE whose new size exceeds 65536 entries	report	report omit	spec; gw	structural

placeable-header

Data attack risks exist if the magic number is malformed, which may indicate format confusion attacks. Checksum mismatch indicates tampering or corruption. Inconsistent bounding box coordinates can trigger integer overflow in renderer dimension calculations. A zero resolution value causes division by zero in coordinate transforms. The reserved field must be zero; non-zero values may hide data.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
placeable-header-bounding-box	gw-DQ3FGNR	Detect inconsistent BoundingBox coordinates (Left > Right or Top > Bottom)	report	report omit	spec; gw	structural
placeable-header-checksum	gw-V13JQNH	Detect a checksum field (XOR of the first 10 WORDs) that disagrees with the computed value	report	report omit	spec; gw	structural
placeable-header-magic	gw-FXBGZ9Q	Detect a placeable header magic number that is not 0x9AC6CDD7	report	report omit	spec; gw	structural
placeable-header-reserved	gw-EJKFWZW	Detect a non-zero placeable header Reserved field (must be 0x00000000)	replace	replace report omit	gw	structural
placeable-header-zero-inch	gw-MM7KR3Q	Detect a placeable header Inch (resolution) field of 0	reject	report omit	spec; gw	structural

polygon-region-records

Integer overflow in vertex count sums causes undersized buffer allocation followed by heap overflow (CVE-2006-2376, MS06-026). Mismatch between point counts and record size causes out-of-bounds read/write. Complex region data parsing has historically been vulnerable to buffer overflows. Extreme coordinates can cause integer overflow in rendering calculations.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
point-coordinate-bounds	gw-1ET88JS	Detect point coordinates outside the declared bounding box or window extent	report	report omit	spec; gw	structural
polygon-point-count-consistency	gw-K6HCSX1	Detect a META_POLYGON/META_POLYLINE whose NumberOfPoints is inconsistent with RecordSize	report	report omit	spec; gw	structural
polypolygon-vertex-overflow	gw-XVM0SW7	Detect a META_POLYPOLYGON where the sum of all polygon vertex counts overflows a 32-bit integer	report	report omit	spec; cve; gw	structural
region-data-consistency	gw-3WBPPQD	Detect a META_CREATEREGION whose region data size is inconsistent with RecordSize or exceeds reasonable bounds	report	report omit	spec; gw	structural

post-cdr-validation

Remediation may produce a structurally invalid WMF that fails to render.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
post-cdr-round-trip	gw-D1E30S6	Detect a protected WMF output that fails post-CDR round-trip re-parse (missing header, missing EOF record or otherwise structurally invalid)	report	report omit	gw	structural

record-chain

Records smaller than 3 WORDs are malformed and may cause infinite loops or negative seeks. Records extending past EOF cause out-of-bounds reads. Missing EOF indicates truncation; multiple EOFs indicate appended data. Oscillating record sizes are a known DoS pattern causing 100% CPU consumption. Trailing data after META_EOF can hide arbitrary payloads. Unknown record types indicate corruption, future format extensions or deliberate obfuscation.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
record-chain-cumulative-size	gw-BGJT8TN	Detect cumulative record sizes that exceed the file length	report	report omit	spec; gw	structural
record-chain-eof-present	gw-QG0STSW	Detect data present after the META_EOF record	remove	remove report omit	gw	structural
record-chain-known-types	gw-JKR9HW8	Detect a RecordFunction value that is not a known value from the RecordType enumeration	report	report omit	spec; gw	structural
record-chain-minimum-size	gw-DC19TTB	Detect a record whose RecordSize is less than 3 WORDs (minimum: size + type fields)	report	report omit	spec; gw	structural
record-chain-oscillating-sizes	gw-WGA0WR9	Detect consecutive records whose sizes oscillate (e.g., +3/-3), a pattern that can create an infinite loop	report	report omit	spec; gw	structural
record-chain-single-eof	gw-CMGQH2D	Detect a record chain that does not terminate with exactly one META_EOF record	report	report omit	spec; gw	structural
record-chain-trailing-data	gw-TAGY5R3	Detect trailing data after the META_EOF record	report	report omit	spec; gw	structural
record-chain-trailing-data-remove	gw-RPPAK3Y	Detect trailing data after the META_EOF record that can be removed	remove	remove report omit	gw	structural
record-chain-unknown-types	gw-05N7054	Detect unknown/undocumented record types	report	report omit	spec; gw	structural
record-chain-unknown-types-reject	gw-XE80ADG	Detect unknown or unrecognized record types	reject	report omit	spec; gw	structural

text-records

String length exceeding available record data causes buffer over-read. Malformed clipping rectangles in META_EXTTEXTOUT can trigger integer overflow.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
text-clipping-rect-consistency	gw-YY1K9DW	Detect a META_EXTTEXTOUT with an inconsistent optional clipping rectangle	report	report omit	spec; gw	structural
text-content-disclosure	gw-T1VZ4RW	Detect text content that may contain sensitive information	report	report omit	gw	visual
text-string-length-consistency	gw-N98JZVC	Detect a StringLength inconsistent with RecordSize	report	report omit	spec; gw	structural

H.264 (h264)

access-unit-delimiter

AUD NAL units are structurally simple (1-byte payload); an oversized AUD could carry hidden data after the primary_pic_type field.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
aud-primary-pic-type-out-of-range	gw-AVFN14W	Detect an AUD primary_pic_type outside the range 0-7	report	report omit	spec; gw	structural
aud-size-oversized	gw-SYYT35N	Detect an AUD NAL unit whose RBSP size exceeds the expected 1 byte (primary_pic_type + trailing bits)	report	report omit	spec; gw	structural

emulation-prevention

Incorrect emulation prevention byte handling causes parser differentials and heap overflows; CVE-2024-22860 demonstrated a heap buffer overflow during RBSP decoding when emulation prevention bytes were incorrectly counted.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
emulation-prevention-byte-misplaced	gw-G5CCR9Z	Detect an emulation prevention byte (0x03 after 0x0000) incorrectly placed per Annex B	report	report omit	spec; cve	structural
emulation-prevention-invalid	gw-46P0V6P	Detect RBSP data containing 0x000000, 0x000001 or 0x000002 without proper emulation prevention	report	report omit	spec; cve	structural

filler-data

Filler data NAL units are defined as 0xFF padding bytes for CBR rate control; modified byte values can carry steganographic content that is invisible to video playback but extractable by a receiver.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
filler-data-content-invalid	gw-RR9MRV1	Detect a retained filler data NAL unit whose payload bytes are not all 0xFF	report	report omit	spec; gw	structural
filler-nal-present	gw-VMERW3G	Detect a filler data NAL unit (nal_unit_type 12)	remove	remove report omit	isg; gw	structural

nal-header

A set forbidden_zero_bit indicates a corrupt or crafted NAL unit; reserved and unspecified NAL unit types may be misinterpreted by different decoders (parser differential attacks) and can carry hidden data that no standard decoder processes; nal_ref_idc inconsistency with NAL type indicates structural corruption.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
forbidden-zero-bit-reject	gw-8HPWN2N	Detect a NAL unit with forbidden_zero_bit set to 1	reject	report omit	spec; isg; gw	structural
forbidden-zero-bit-set	gw-K3PGXMZ	Detect a NAL unit whose forbidden_zero_bit is set to 1	report	report omit	spec; isg; gw	structural
nal-ref-idc-nonzero-invalid	gw-W01HTMS	Detect a non-zero nal_ref_idc on a NAL unit of type 6 (SEI), 9 (AUD), 10 (EOS), 11 (EOB) or 12 (filler)	report	report omit	spec; gw	structural
nal-ref-idc-zero-invalid	gw-FBW21AF	Detect a zero nal_ref_idc on a NAL unit of type 5 (IDR), 7 (SPS), 8 (PPS) or 15 (subset SPS)	report	report omit	spec; gw	structural
nal-type-undefined	gw-GBVZ5RV	Detect a nal_unit_type outside the range of defined types (1-12, 13-15, 19-21)	report	report omit	spec; gw	structural
unspecified-nal-present	gw-43B38B1	Detect an unspecified or reserved NAL unit (nal_unit_type 0, 22-23 or 24-31)	remove	remove report omit	isg; gw	structural

pps-parameters

PPS fields control reference picture list sizing for all slices that reference this PPS; crafted reference index override values cause heap overflow, and a PPS must reference a valid SPS.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
pps-id-out-of-range	gw-3D4Z9A2	Detect a PPS pic_parameter_set_id outside the range 0-255	reject	report omit	spec; gw	structural
pps-ref-idx-exceeds-sps	gw-KR6Q75Q	Detect a PPS num_ref_idx default value exceeding max_num_ref_frames from the referenced SPS	reject	report omit	spec; cve; gw	structural
pps-ref-idx-l0-out-of-range	gw-ZYGJSX6	Detect a PPS num_ref_idx_l0_default_active_minus1 outside the range 0-31	reject	report omit	spec; cve; gw	structural
pps-ref-idx-l1-out-of-range	gw-5JZDZSD	Detect a PPS num_ref_idx_l1_default_active_minus1 outside the range 0-31	reject	report omit	spec; cve; gw	structural
pps-sps-cross-reference-invalid	gw-S058SQD	Detect a PPS seq_parameter_set_id outside the range 0-31 or referencing no active SPS	reject	report omit	spec; cve; gw	structural

sei-messages

SEI payloadSize values exceeding the remaining NAL unit bytes trigger heap buffer overflows; user_data and filler SEI messages carry arbitrary payloads with no effect on decoded video and are the primary H.264 covert channels. Every other Annex D type carries attacker-chosen bytes a decoder does not read for reconstruction, so a type left unowned is a channel that no rule reports.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
sei-filler-payload	gw-1A104GK	Detect a SEI message with payloadType 3 (filler_payload)	remove	remove report omit	isg; gw	structural
sei-hdr-metadata-present	gw-2NSWEE9	Detect a mastering_display_colour_volume (payloadType 137) or content_light_level_info (payloadType 144) HDR metadata SEI message	report	report omit	gw	visual
sei-non-essential-present	gw-0Z2GY6M	Detect a SEI message of any Annex D payload type outside the named and retained sets	remove	remove report omit	isg; gw	structural
sei-payload-bounds-exceeded	gw-KY61VCZ	Detect a SEI NAL unit whose payloadSize exceeds the NAL unit bounds	reject	report omit	spec; cve	structural
sei-payload-size-out-of-bounds	gw-BVK66CA	Detect a SEI message whose payloadSize exceeds the remaining bytes in the NAL unit RBSP	report	report omit	spec; cve	structural
sei-total-size-out-of-bounds	gw-K3HQC38	Detect total SEI message bytes exceeding the NAL unit size	report	report omit	spec; cve	structural
sei-unknown-type	gw-XN7CVCK	Detect a SEI message whose payloadType is not defined in ITU-T H.264 Annex D	remove	remove report omit	isg; gw	structural
sei-user-data-registered	gw-2H0EDJ2	Detect a SEI message with payloadType 4 (user_data_registered_itu_t_t35)	remove	remove report omit	isg; gw	functional
sei-user-data-unregistered	gw-JCHWPW5	Detect a SEI message with payloadType 5 (user_data_unregistered)	remove	remove report omit	isg; gw	functional

slice-header

Slice header fields reference PPS (which references SPS), creating a chain of dependent parameters; a crafted first_mb_in_slice exceeding frame dimensions causes out-of-bounds access, and crafted reference list reordering caused kernel RCE in Apple AVD.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
first-mb-out-of-range	gw-HYVERA1	Detect a slice first_mb_in_slice outside the range 0 to (PicSizeInMbs - 1)	report	report omit	spec; cve	structural
first-slice-not-idr	gw-3K4WVWD	Detect a first coded slice in the stream that is not an IDR slice (nal_unit_type 5)	report	report omit	spec; gw	structural
frame-num-out-of-range	gw-4NVAHAY	Detect a slice frame_num outside the range 0 to (MaxFrameNum - 1)	report	report omit	spec	structural
idr-pic-id-out-of-range	gw-260ZKYZ	Detect an IDR slice idr_pic_id outside the range 0-65535	report	report omit	spec	structural
slice-pps-id-invalid	gw-BZBRFBM	Detect a slice pic_parameter_set_id that references no active PPS	report	report omit	spec; cve	structural
slice-type-out-of-range	gw-PP4FTQW	Detect a slice slice_type outside the range 0-9	report	report omit	spec	structural

sps-parameters

Crafted SPS dimension values cause integer overflow in width*height multiplication, leading to small buffer allocation followed by large data writes; invalid profile/level, chroma, bit-depth and picture-order-count values trigger type confusion, incorrect buffer sizing, excessive allocation or infinite parsing loops in decoders.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
parameter-set-id-conflict	gw-NTMJK2S	Detect two sequence parameter sets that share a seq_parameter_set_id while coding different pictures	remove	remove report omit	spec; gw	structural
sps-bit-depth-chroma-out-of-range	gw-T9A6VRD	Detect a SPS bit_depth_chroma_minus8 outside the range 0-6	reject	report omit	spec; cve; gw	structural
sps-bit-depth-luma-out-of-range	gw-X97P7K2	Detect a SPS bit_depth_luma_minus8 outside the range 0-6	reject	report omit	spec; cve; gw	structural
sps-chroma-format-idc-out-of-range	gw-X3FZ7GD	Detect a SPS chroma_format_idc outside the range 0-3	reject	report omit	spec; cve; gw	structural
sps-frame-size-excessive	gw-XXNGSJ8	Detect a SPS whose computed frame size exceeds 8192x8192 or the level-defined MaxFS	reject	report omit	spec; cve; gw	structural
sps-height-out-of-range	gw-MS67W3J	Detect a SPS pic_height_in_map_units_minus1 that produces a frame height exceeding 8192 pixels	reject	report omit	spec; cve; gw	structural
sps-id-out-of-range	gw-7WA5J83	Detect a SPS seq_parameter_set_id outside the range 0-31	reject	report omit	spec; gw	structural
sps-level-idc-invalid	gw-7WYJ9FJ	Detect a SPS level_idc that is not a recognized level value	replace	replace report omit	spec; gw	structural
sps-log2-max-frame-num-out-of-range	gw-E58FF7V	Detect a SPS log2_max_frame_num_minus4 outside the range 0-12	reject	report omit	spec; gw	structural
sps-log2-max-poc-lsb-out-of-range	gw-FVDEXJC	Detect a SPS log2_max_pic_order_cnt_lsb_minus4 outside the range 0-12	reject	report omit	spec; gw	structural
sps-max-ref-frames-out-of-range	gw-GTV864C	Detect a SPS max_num_ref_frames outside the range 0-16	reject	report omit	spec; cve; gw	structural
sps-num-ref-frames-poc-cycle-out-of-range	gw-66VC06C	Detect a SPS num_ref_frames_in_pic_order_cnt_cycle outside the range 0-255	reject	report omit	spec; cve; gw	structural
sps-poc-type-out-of-range	gw-XY5HQ47	Detect a SPS pic_order_cnt_type outside the range 0-2	reject	report omit	spec; cve; gw	structural
sps-profile-idc-invalid	gw-BZV39BG	Detect a SPS profile_idc that is not a recognized profile value	reject	report omit	spec; cve; gw	structural
sps-width-out-of-range	gw-XA4710M	Detect a SPS pic_width_in_mbs_minus1 that produces a frame width exceeding 8192 pixels	reject	report omit	spec; cve; gw	structural

stream-structure

Malformed start codes cause parser differentials between Genesis and downstream decoders, enabling NAL unit smuggling; missing parameter sets before coded slices crash decoders; non-zero trailing data after the last NAL unit may carry hidden payloads.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
content-after-end-of-stream	gw-2FWMSS5	Detect NAL units that follow the end_of_stream NAL unit	remove	remove report omit	spec; gw	structural
leading-gap-content-present	gw-0G4F6XA	Detect non-zero data before the first start code prefix	remove	remove report omit	spec; gw	structural
nal-unit-absent	gw-EQ6N5A2	Detect a byte stream containing no NAL units	report	report omit	spec; gw	structural
pps-absent	gw-PKKFG5X	Detect no PPS (nal_unit_type 8) present before the first coded slice	report	report omit	spec; gw	structural
pps-sps-reference-invalid	gw-4ARH64Q	Detect a PPS whose seq_parameter_set_id references no prior SPS	report	report omit	spec; gw	structural
slice-pps-reference-invalid	gw-0H352A3	Detect a coded slice whose pic_parameter_set_id references no prior PPS	report	report omit	spec; gw	structural
sps-absent	gw-CQJQ3XA	Detect no SPS (nal_unit_type 7) present before the first coded slice	report	report omit	spec; gw	structural
start-code-invalid	gw-MGY5RG5	Detect a NAL unit not preceded by a valid start code prefix (0x000001 or 0x00000001)	report	report omit	spec; gw	structural
stream-start-invalid	gw-5ESKN84	Detect a byte stream that does not begin with a start code prefix (leading non-zero data)	report	report omit	spec; gw	structural
trailing-data-present	gw-QJ5262B	Detect non-zero data present after the RBSP of the last NAL unit	remove	remove report omit	gw	structural

H.265 (h265)

filler-data

Filler data NAL units and SEI payloads contain bytes ignored by decoders. They serve no content purpose and are a data-hiding channel.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
filler-nal-present	gw-W7EC4JN	Detect a filler-data NAL unit (type 38) or filler SEI payload (payloadType 3)	remove	remove report omit	gw	structural

nal-header

Malformed NAL headers cause parser state corruption. The forbidden_zero_bit indicates corruption, invalid types trigger undefined behavior, and a zero temporal_id causes decoder crashes.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
nal-forbidden-zero-bit-reject	gw-R87T8PN	Detect a NAL unit with forbidden_zero_bit set to 1 that cannot be safely repaired	reject	report omit	spec; cve; gw	structural
nal-layer-id-nonzero	gw-DCYF873	Detect a NAL unit with nuh_layer_id not equal to 0 in a single-layer stream	report	report omit	spec; gw	functional
nal-temporal-id-zero	gw-SF2WE2R	Detect a NAL unit with nuh_temporal_id_plus1 equal to 0 (forbidden)	report	report omit	spec; gw	functional
nal-type-out-of-range	gw-KR3C7QT	Detect a NAL unit whose nal_unit_type is outside the 0-63 range	report	report omit	spec; gw	structural
param-set-temporal-id-invalid	gw-DZ4K4SA	Detect a VPS/SPS/PPS NAL unit whose nuh_temporal_id_plus1 is not 1	report	report omit	spec; gw	functional

nal-ordering

Parameter sets must precede the NAL units that reference them. Out-of-order NAL units cause parser differentials between Genesis and the decoder, enabling bypass attacks.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
aud-ordering-invalid	gw-78RSSPB	Detect an access-unit delimiter (type 35) not appearing first in its access unit	report	report omit	spec; gw	functional
pps-after-slice	gw-59TX379	Detect a PPS appearing after a slice that references it	report	report omit	spec; gw	functional
sps-after-pps	gw-6WVFPJW	Detect an SPS appearing after a PPS that references it	report	report omit	spec; gw	functional
vps-after-sps	gw-PYQ5CXK	Detect a VPS appearing after an SPS that references it	report	report omit	spec; gw	functional

nal-type

Reserved (10-15, 22-31, 41-47) and unspecified (48-63) NAL types carry no defined semantics and are data-hiding vectors; parsers handle them inconsistently, creating differential vulnerabilities. VCL NAL units that reference a missing PPS crash decoders.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
nal-type-defined-range-invalid	gw-2JY7HG7	Detect a NAL unit whose nal_unit_type is outside the defined range 0-40	report	report omit	spec; cve; gw	structural
reserved-nal-present	gw-0QNEYJB	Detect a NAL unit with a reserved type (10-15, 22-23, 24-31 or 41-47)	remove	remove report omit	cve; gw	structural
unspecified-nal-present	gw-2K1QYQW	Detect a NAL unit with an unspecified type (48-63)	remove	remove report omit	cve; gw	structural
vcl-pps-reference-invalid	gw-KD50SB0	Detect a VCL NAL unit (types 0-31) that does not reference a valid PPS	report	report omit	spec; gw	functional

pps

PPS must reference a valid SPS; invalid references cause uninitialized decoder state and parser crashes. Tile column/row counts control memory allocation for parallel decoding structures and crafted values cause heap buffer overflows (CVE-2020-21603); out-of-range reference counts and QP values cause array index violations.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
pps-absent	gw-J5Y57PX	Detect a stream with no PPS NAL unit (type 34) present	reject	report omit	spec; cve; gw	functional
pps-cb-qp-offset-out-of-range	gw-7JW97K1	Detect a pps_cb_qp_offset outside the range -12 to 12	reject	report omit	spec; cve; gw	functional
pps-cr-qp-offset-out-of-range	gw-9Z1CXQ9	Detect a pps_cr_qp_offset outside the range -12 to 12	reject	report omit	spec; cve; gw	functional
pps-id-out-of-range	gw-GW6R3F1	Detect a pps_pic_parameter_set_id outside the range 0-63	reject	report omit	spec; cve; gw	functional
pps-init-qp-out-of-range	gw-YD8QGST	Detect an init_qp_minus26 outside the range -26 to 25	reject	report omit	spec; cve; gw	functional
pps-ref-idx-l0-out-of-range	gw-XX1DHZ0	Detect a num_ref_idx_l0_default_active_minus1 outside the range 0-14	reject	report omit	spec; cve; gw	functional
pps-ref-idx-l1-out-of-range	gw-R7J3X9E	Detect a num_ref_idx_l1_default_active_minus1 outside the range 0-14	reject	report omit	spec; cve; gw	functional
pps-sps-reference-invalid	gw-GD3TVNE	Detect a pps_seq_parameter_set_id that does not reference a previously parsed SPS	reject	report omit	spec; cve; gw	functional
pps-tile-column-sum-inconsistent	gw-H6Z2WRH	Detect tile column widths that do not sum to PicWidthInCtbsY	reject	report omit	spec; cve; gw	functional
pps-tile-columns-out-of-range	gw-KXP6CV8	Detect a num_tile_columns_minus1 outside the range 0-19 when tiles_enabled_flag is 1	reject	report omit	spec; cve; gw	functional
pps-tile-count-excessive	gw-VV6X0TH	Detect a total tile count (columns times rows) exceeding 440 (Level 6.2 maximum)	reject	report omit	spec; cve; gw	functional
pps-tile-row-sum-inconsistent	gw-YMJ5TA7	Detect tile row heights that do not sum to PicHeightInCtbsY	reject	report omit	spec; cve; gw	functional
pps-tile-rows-out-of-range	gw-W1YPFV4	Detect a num_tile_rows_minus1 outside the range 0-21 when tiles_enabled_flag is 1	reject	report omit	spec; cve; gw	functional

sei-messages

SEI messages carry data no standard decoder needs to render video. user_data payloads are the primary H.265 data-hiding and exfiltration channel; pic_timing and recovery_point disclose decoding state; non-essential payloads carry hidden data; malformed type/size continuation encoding causes integer overflows and buffer over-reads.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
sei-hdr-metadata-present	gw-HJ75FAB	Detect a mastering_display_colour_volume (payloadType 137) or content_light_level_info (payloadType 144) HDR metadata SEI message	report	report omit	gw	visual
sei-non-essential-present	gw-HVHWE8S	Detect a non-essential SEI message outside the retained (HDR metadata) set	remove	remove report omit	gw	structural
sei-payload-absent	gw-BAZJZ0N	Detect a SEI NAL unit containing no valid SEI payload	report	report omit	spec; cve; gw	structural
sei-recovery-point-present	gw-1N8H3ZC	Detect a recovery_point (payloadType 6) SEI message	remove	remove report omit	gw	structural
sei-size-out-of-bounds	gw-N6X4G9H	Detect a SEI payloadSize exceeding the remaining NAL unit bytes	report	report omit	spec; cve; gw	structural
sei-timing-present	gw-BAYF6DY	Detect a pic_timing (payloadType 1) SEI message	remove	remove report omit	gw	structural
sei-type-encoding-invalid	gw-0ZC9YDV	Detect a SEI payloadType using an invalid 0xFF continuation encoding	report	report omit	spec; cve; gw	structural
sei-user-data-present	gw-2XK8DY5	Detect a user_data_registered_itu_t_t35 (payloadType 4) or user_data_unregistered (payloadType 5) SEI message	remove	remove report omit	cve; gw	structural

slice-segments

Slice segment headers reference PPS and reference-picture sets; invalid references cause decoder crashes and memory corruption.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
idr-slice-type-invalid	gw-E7855VD	Detect an IDR picture (NAL types 19-20) with slice_type not equal to 2 (I-slice)	report	report omit	spec; gw	functional
slice-first-flag-invalid	gw-D93WJR3	Detect a first_slice_segment_in_pic_flag not set to 1 for the first slice in a picture	report	report omit	spec; gw	functional
slice-nal-type-inconsistent	gw-0J6MYHG	Detect a slice NAL type inconsistent with the referenced PPS and SPS	report	report omit	spec; cve; gw	functional
slice-pps-reference-invalid	gw-MBG96YY	Detect a slice_pic_parameter_set_id that does not reference a valid PPS	report	report omit	spec; cve; gw	functional
slice-type-out-of-range	gw-5P7CKSP	Detect a slice_type not equal to 0 (B), 1 (P) or 2 (I)	report	report omit	spec; gw	functional

sps

SPS is the primary attack surface for H.265 decoder exploits (19+ CVEs in libde265). Invalid IDs cause cross-reference failures; crafted picture dimensions are the root cause of heap buffer overflows; excessive reference-picture and coding-tool values cause memory exhaustion, use-after-free and buffer over-reads.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
general-level-idc-invalid	gw-6SW7NKN	Detect a general_level_idc that Annex A does not define or that is too small for the coded picture	replace	replace report omit	spec; gw	structural
sps-absent	gw-B2YJ2CP	Detect a stream with no SPS NAL unit (type 33) present	reject	report omit	spec; cve; gw	functional
sps-bit-depth-chroma-out-of-range	gw-D8BNJV3	Detect a bit_depth_chroma_minus8 outside the range 0-8	reject	report omit	spec; cve; gw	functional
sps-bit-depth-luma-out-of-range	gw-2SN0EHY	Detect a bit_depth_luma_minus8 outside the range 0-8	reject	report omit	spec; cve; gw	functional
sps-cb-size-diff-out-of-range	gw-4F4SVK0	Detect a log2_diff_max_min_luma_coding_block_size outside the range 0-3	reject	report omit	spec; cve; gw	functional
sps-chroma-format-invalid	gw-FN6229T	Detect a chroma_format_idc outside the range 0-3	reject	report omit	spec; gw	functional
sps-conformance-window-out-of-bounds	gw-4F5YXEG	Detect conformance-window crop offsets exceeding the picture dimensions when conformance_window_flag is 1	replace	replace report omit	spec; gw	functional
sps-dimensions-excessive	gw-FC45FXN	Detect picture dimensions exceeding 16384 in either axis	reject	report omit	spec; cve; gw	functional
sps-dpb-size-out-of-range	gw-K41DYAF	Detect an sps_max_dec_pic_buffering_minus1 outside the range 0-15 per sub-layer	reject	report omit	spec; cve; gw	functional
sps-id-out-of-range	gw-D7R1MDS	Detect an sps_seq_parameter_set_id outside the range 0-15	reject	report omit	spec; cve; gw	functional
sps-latency-out-of-range	gw-HHKRD8D	Detect an sps_max_latency_increase_plus1 outside its valid range	reject	report omit	spec; gw	functional
sps-long-term-rps-count-out-of-range	gw-WP8AM00	Detect a num_long_term_ref_pics_sps outside the range 0-32	reject	report omit	spec; cve; gw	functional
sps-min-cb-size-out-of-range	gw-AB721DC	Detect a log2_min_luma_coding_block_size_minus3 outside the range 0-3	reject	report omit	spec; cve; gw	functional
sps-min-tb-size-out-of-range	gw-N4QK50H	Detect a log2_min_luma_transform_block_size_minus2 outside the range 0-3	reject	report omit	spec; cve; gw	functional
sps-pic-height-out-of-range	gw-GNV87T6	Detect a pic_height_in_luma_samples outside the range 1-16384	reject	report omit	spec; cve; gw	functional
sps-pic-width-out-of-range	gw-1ADR3FV	Detect a pic_width_in_luma_samples outside the range 1-16384	reject	report omit	spec; cve; gw	functional
sps-pixel-count-excessive	gw-CJJMYS6	Detect a pic_width times pic_height product exceeding 268435456 luma samples	reject	report omit	spec; cve; gw	functional
sps-poc-range-out-of-range	gw-G5KQTS9	Detect a log2_max_pic_order_cnt_lsb_minus4 outside the range 0-12	reject	report omit	spec; cve; gw	functional
sps-reorder-pics-inconsistent	gw-5Y1V1D5	Detect an sps_max_num_reorder_pics greater than sps_max_dec_pic_buffering_minus1	reject	report omit	spec; cve; gw	functional
sps-short-term-rps-count-out-of-range	gw-2EV5742	Detect a num_short_term_ref_pic_sets outside the range 0-64	reject	report omit	spec; cve; gw	functional
sps-sub-layer-count-out-of-range	gw-0E0FD82	Detect an sps_max_sub_layers_minus1 outside the range 0-6	reject	report omit	spec; gw	functional
sps-tb-size-diff-out-of-range	gw-V39BM3C	Detect a log2_diff_max_min_luma_transform_block_size outside the range 0-3	reject	report omit	spec; cve; gw	functional
sps-tx-depth-inter-out-of-range	gw-XMDTTTJ	Detect a max_transform_hierarchy_depth_inter outside the range 0-4	reject	report omit	spec; cve; gw	functional
sps-tx-depth-intra-out-of-range	gw-RCQC2C6	Detect a max_transform_hierarchy_depth_intra outside the range 0-4	reject	report omit	spec; cve; gw	functional
sps-vps-reference-invalid	gw-1E184B2	Detect an sps_video_parameter_set_id that does not reference a previously parsed VPS	reject	report omit	spec; cve; gw	functional

stream-format

Missing or malformed start codes prevent NAL unit boundary detection and may indicate a crafted stream designed to exploit parser desynchronization between Genesis and the decoder.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
leading-gap-content-present	gw-G997AWW	Detect non-zero data before the first start code prefix	remove	remove report omit	spec; gw	structural
nal-unit-size-below-minimum	gw-1FEKERM	Detect a NAL unit shorter than the 2-byte minimum H.265 NAL header size	report	report omit	spec; gw	structural
start-code-absent-unparseable	gw-KZPPJR0	Detect a stream in which no valid start code can be found	reject	report omit	spec; gw	structural
start-code-integrity-invalid	gw-RX4X10Q	Detect a NAL unit not preceded by a valid start code prefix	report	report omit	spec; gw	structural
start-code-prefix-missing	gw-GDP6QW1	Detect a stream that does not begin with a start code prefix (0x000001 or 0x00000001)	report	report omit	spec; gw	structural

structural-integrity

Resource exhaustion from excessive NAL counts, oversized streams or parameter-set bombing; emulation-prevention byte errors cause parser desynchronization; reserved bits flagged by ITU-T H.265 carry no decoder semantics and a non-zero value is a steganographic signal.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
emulation-prevention-invalid	gw-14RKGY7	Detect an invalid emulation-prevention byte (0x03 after 0x0000) within a NAL payload	report	report omit	spec; gw	structural
nal-count-excessive	gw-9D25GPR	Detect a NAL unit count exceeding the configured maximum (default 100000)	report	report omit	spec; gw	structural
parameter-set-id-conflict	gw-376BAJT	Detect two parameter sets that share an id while coding different pictures	remove	remove report omit	spec; gw	structural
pps-count-excessive	gw-8QKGFN6	Detect a PPS count exceeding 64	report	report omit	spec; gw	structural
reserved-fields-nonzero	gw-VSPRES0	Detect non-zero reserved padding bits in the RBSP trailing byte of a VPS/SPS/PPS parameter set	replace	replace report omit	spec; gw	structural
sps-count-excessive	gw-ZQ4H44C	Detect an SPS count exceeding 16	report	report omit	spec; gw	structural
stream-size-excessive	gw-P9BPD5J	Detect a total stream size exceeding the configured maximum (default 1 GB)	report	report omit	spec; gw	structural
vcl-nal-absent	gw-43DC8AC	Detect a stream with no VCL NAL unit (types 0-9, 16-21) present	report	report omit	spec; gw	structural
vps-count-excessive	gw-BGDEJXH	Detect a VPS count exceeding 16	report	report omit	spec; gw	structural

trailing-data

Data after the last NAL unit or after an end_of_bitstream NAL is not part of the H.265 stream and may contain hidden content, appended payloads or polyglot data.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
content-after-end-of-stream	gw-2E8XTVW	Detect NAL units that follow the end-of-sequence or end-of-bitstream NAL unit	remove	remove report omit	spec; gw	structural
trailing-data-after-eob-invalid	gw-TSCHX54	Detect data present after the end_of_bitstream NAL unit (type 37)	report	report omit	spec; gw	structural
trailing-data-present	gw-67P1QK6	Detect data present after the last NAL unit in the stream	remove	remove report omit	gw	structural

vps

The VPS defines the overall video coding configuration. Missing VPS prevents correct stream initialization; crafted layer/sub-layer counts cause allocation overflows; crafted timing values cause integer overflows in frame-rate calculations (CVE-2024-31585 FFmpeg HRD overflow).

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
vps-absent	gw-FRSPS4Y	Detect a stream with no VPS NAL unit (type 32) present	reject	report omit	spec; gw	functional
vps-id-out-of-range	gw-8T34QPK	Detect a vps_video_parameter_set_id outside the range 0-15	reject	report omit	spec; gw	functional
vps-layer-count-invalid	gw-8VWT9E1	Detect a vps_max_layers_minus1 not equal to 0 in a single-layer stream	reject	report omit	spec; gw	functional
vps-sub-layer-count-out-of-range	gw-0FYZEJA	Detect a vps_max_sub_layers_minus1 outside the range 0-6	reject	report omit	spec; gw	functional
vps-temporal-nesting-invalid	gw-GV6HZFE	Detect a vps_temporal_id_nesting_flag not set to 1 when vps_max_sub_layers_minus1 is 0	reject	report omit	spec; gw	functional
vps-time-scale-invalid	gw-27M6911	Detect a vps_time_scale of 0 when timing information is present	replace	replace report omit	spec; cve; gw	functional
vps-timing-units-invalid	gw-D8EG91B	Detect a vps_num_units_in_tick of 0 when timing information is present	replace	replace report omit	spec; cve; gw	functional

SIDD (sidd)

annotations

Excessive annotation counts cause rendering DoS. Oversized annotation text fields can carry covert channel data. Invalid geometry coordinates can cause renderer crashes.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
annotation-count-excessive	gw-0VWADCH	Detect more than 1000 annotations (rendering denial-of-service vector)	reject	report omit	spec; gw	functional
annotation-count-invalid	gw-1Q2AB6Q	Detect a total annotation count exceeding 1000	report	report omit	spec; gw	functional
annotation-identifier-invalid	gw-Q629WZD	Detect an Annotation/Identifier that is empty or longer than 256 characters	report	report omit	spec; gw	functional
line-vertices-invalid	gw-DSY4R9T	Detect line geometry with fewer than 2 vertices or invalid coordinates	report	report omit	spec; gw	functional
point-vertices-invalid	gw-057GREV	Detect point geometry with non-finite coordinates	report	report omit	spec; gw	functional
polygon-vertices-invalid	gw-BS035SQ	Detect polygon geometry with fewer than 3 vertices or invalid coordinates	report	report omit	spec; gw	functional
text-length-invalid	gw-0Z5DT6W	Detect annotation text content exceeding 4096 characters	report	report omit	spec; gw	functional

classification

Classification marking tampering is the highest-risk threat for SIDD files. Mismatched markings between SIDD XML and NITF headers cause security spillage, an unregistered codeword or releasability value grants handling no register defines, and markings that contradict each other let a reader who honors one of them under-protect the product.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
classification-marking-confusable	gw-RTWES0X	Detect a SIDD classification that matches the NITF security fields only after unicode folding	reject	report omit	gw; analogy	functional
declassification-marking-incoherent	gw-QGZQ12Z	Detect declassification instructions that contradict the classification or each other	reject	report omit	spec; gw	functional
declassification-marking-invalid	gw-00N9G0B	Detect a declassification instruction outside the IC-ISM exemption register	report	report omit	spec; gw	functional
dissemination-marking-invalid	gw-NKN89NC	Detect a dissemination control marking outside the IC-ISM register	report	report omit	spec; gw	functional
marking-exceeds-level	gw-9QKJ44W	Detect a compartment or restricted-data marking on unclassified content	reject	report omit	spec; gw	functional
marking-token-limit-exceeded	gw-MMEWKVW	Detect a marking list carrying more tokens than the IC-ISM schema permits	report	report omit	spec; gw	functional
releasability-marking-incoherent	gw-43873GB	Detect releasability and dissemination markings that contradict each other	reject	report omit	spec; gw	functional
releasability-marking-invalid	gw-XN0ASSH	Detect a releasability marking outside the IC-ISM country register	report	report omit	spec; gw	functional
required-marking-absent	gw-6TR4PZZ	Detect a required IC-ISM marking absent from the Classification element	reject	report omit	spec; gw	functional
security-classification-invalid	gw-CJHN188	Detect a classification level outside the IC-ISM portion-mark register	report	report omit	spec; gw	functional
security-control-system-invalid	gw-1ST95XK	Detect a control-system marking outside the IC-ISM codeword register	report	report omit	spec; gw	functional
security-policy-identifier-invalid	gw-FS95YTK	Detect a compliance declaration outside the IC-ISM register	report	report omit	spec; gw	functional

des-identification

Non-standard DESID values could bypass SIDD detection. DES count mismatches indicate structural tampering. Version mismatches may cause parser confusion. A DES that shares the XML_DATA_CONTENT identifier but carries a non-SIDD dialect (e.g. SICD) is content the SIDD camera cannot inspect and must not pass through unremediated.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
data-length-invalid	gw-SDRRAYB	Detect a DES data length inconsistent with the actual XML content size	report	report omit	spec; gw	functional
des-count-invalid	gw-REK69W3	Detect a NUMDES in the NITF header inconsistent with the actual DES segment count	report	report omit	spec; gw	functional
des-identifier-invalid	gw-HM4A51T	Detect a DES identifier (DESID) that is not 'XML_DATA_CONTENT' for a SIDD DES	report	report omit	spec; gw	functional
des-version-invalid	gw-T0MY6CJ	Detect a DES version (DESVER) that is not a valid SIDD version	report	report omit	spec; gw	functional
sidd-des-missing	gw-Q7CMXF2	Detect no DES segment carrying SIDD XML metadata	reject	report omit	spec; gw	functional
unsupported-schema-version	gw-T57H90C	Detect a recognized SIDD-family namespace (SIDD / SICommon / SFA / IC-ISM) declared at a schema version Genesis does not support	reject	report omit	gw	functional
unsupported-xml-des	gw-SDCXDES	Detect an XML_DATA_CONTENT DES whose XML root is not a SIDD namespace (unsupported variant, e.g. SICD)	reject	report omit	isg; gw	functional

display

Invalid pixel type or band count values can cause buffer miscalculation in image renderers. Inconsistent band indices cause out-of-bounds access.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
band-count-invalid	gw-91YSXCQ	Detect a NumBands inconsistent with PixelType (1 for mono types, 3 for RGB types)	report	report omit	spec; gw	functional
band-indices-invalid	gw-ZJQ2CX3	Detect a DefaultBandDisplay index outside the range 1 to NumBands	report	report omit	spec; gw	functional
downsampling-method-invalid	gw-HQPDMRJ	Detect a DownsamplingMethod that is not a valid enumeration value	report	report omit	spec; gw	functional
pixel-type-invalid	gw-1QD19NY	Detect a PixelType other than MONO8I, MONO8LU, MONO16I, RGB8LU or RGB24I	report	report omit	spec; gw	functional

downstream-reprocessing

Zero or negative chip dimensions can cause buffer allocation errors in downstream processors.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
chip-size-column-invalid	gw-VVQPFH5	Detect a GeometricChip/ChipSize/Col that is not a positive integer	report	report omit	spec; gw	functional
chip-size-row-invalid	gw-X7MMGSH	Detect a GeometricChip/ChipSize/Row that is not a positive integer	report	report omit	spec; gw	functional

exploitation-features

Invalid collection geometry angles can mislead SAR image interpretation. Non-finite resolution values cause rendering errors.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
azimuth-invalid	gw-MN58M6K	Detect a Geometry/Azimuth outside the range 0.0 to 360.0 degrees	report	report omit	spec; gw	functional
collection-datetime-invalid	gw-GQ1469Z	Detect a Collection/DateTime that is not a valid ISO 8601 datetime	report	report omit	spec; gw	functional
collection-duration-invalid	gw-G190WXV	Detect a CollectionDuration that is not positive and finite	report	report omit	spec; gw	functional
collection-identifier-invalid	gw-JSMB9H3	Detect a Collection/Identifier that is empty or longer than 256 characters	report	report omit	spec; gw	functional
doppler-cone-angle-invalid	gw-RXBE629	Detect a Geometry/DopplerConeAngle outside the range 0 to under 180 degrees	report	report omit	spec; gw	functional
ellipticity-invalid	gw-WP9N4WZ	Detect a Product/Ellipticity that is not positive and finite	report	report omit	spec; gw	functional
graze-invalid	gw-SP3K0TP	Detect a Geometry/Graze outside the range 0.0 to 90.0 degrees	report	report omit	spec; gw	functional
ground-track-angle-invalid	gw-0EJ93RZ	Detect a Phenomenology/GroundTrack angle outside the range -180 to 180 degrees	report	report omit	spec; gw	functional
layover-magnitude-invalid	gw-MB1H8VX	Detect a Phenomenology/Layover magnitude that is not positive and finite	report	report omit	spec; gw	functional
multipath-angle-invalid	gw-YAV8V4C	Detect a Phenomenology/MultiPath angle outside the range -180 to 180 degrees	report	report omit	spec; gw	functional
north-angle-invalid	gw-BMVB1DH	Detect a Product/North angle outside the range -180 to 180 degrees	report	report omit	spec; gw	functional
polarization-invalid	gw-TAPVM25	Detect a processed polarization outside the SICommon enumeration	report	report omit	spec; gw	functional
resolution-column-invalid	gw-5M4Z8ZM	Detect a Product/Resolution/Col that is not a positive finite value	report	report omit	spec; gw	functional
resolution-row-invalid	gw-S2BV02E	Detect a Product/Resolution/Row that is not a positive finite value	report	report omit	spec; gw	functional
sensor-name-invalid	gw-XCG08KD	Detect a Collection/Information/SensorName that is empty or over-long	report	report omit	spec; gw	functional
shadow-magnitude-invalid	gw-QGXJR6T	Detect a Phenomenology/Shadow magnitude that is not positive and finite	report	report omit	spec; gw	functional
slope-invalid	gw-RS97C0G	Detect a Geometry/Slope outside the range 0.0 to 90.0 degrees	report	report omit	spec; gw	functional
squint-invalid	gw-1XA7EF7	Detect a Geometry/Squint outside the range -180.0 to 180.0 degrees	report	report omit	spec; gw	functional
tilt-invalid	gw-VT69Z5X	Detect a Geometry/Tilt outside the range -90.0 to 90.0 degrees	report	report omit	spec; gw	functional

geodata

Geographic coordinate spoofing places imagery at incorrect locations, potentially misleading intelligence analysts. Invalid earth model references cause projection errors.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
corner-count-invalid	gw-N1HN5A4	Detect image corner points other than exactly four with correct index values	report	report omit	spec; gw	functional
corner-latitudes-invalid	gw-CCW5KA6	Detect an image corner point latitude outside the range -90.0 to 90.0	report	report omit	spec; gw	functional
corner-longitudes-invalid	gw-D78DPFV	Detect an image corner point longitude outside the range -180.0 to 180.0	report	report omit	spec; gw	functional
data-bounds-invalid	gw-KQ6KFJ6	Detect a ValidData vertex outside the geographic range or the image bounds	report	report omit	spec; gw	functional
data-vertices-invalid	gw-NXH4FJS	Detect ValidData with fewer than 3 vertices	report	report omit	spec; gw	functional
earth-model-invalid	gw-MG49660	Detect an EarthModel other than 'WGS_84'	report	report omit	spec; gw	functional

measurement

Zero or negative pixel footprint dimensions cause division-by-zero in renderers. NaN or Infinity polynomial coefficients cause floating-point exceptions. Dimension mismatches between SIDD XML and NITF headers indicate structural tampering.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
arp-polynomial-invalid	gw-RJ56GVH	Detect ARPPoly X/Y/Z coefficients that are not finite (NaN or Infinity)	report	report omit	spec; gw	functional
footprint-column-invalid	gw-C902ACT	Detect a PixelFootprint/Col outside the range 1 to 100000	report	report omit	spec; gw	functional
footprint-nitf-inconsistent	gw-VKEP08W	Detect a PixelFootprint inconsistent with the NITF image dimensions	report	report omit	spec; gw	functional
footprint-row-invalid	gw-ZPP3VTA	Detect a PixelFootprint/Row outside the range 1 to 100000	report	report omit	spec; gw	functional
projection-type-invalid	gw-A7X6B6H	Detect a projection element that is not one of the four schema choices	report	report omit	spec; gw	functional
time-coa-polynomial-invalid	gw-Q2CYXWN	Detect TimeCOAPoly coefficients that are not finite (NaN or Infinity)	report	report omit	spec; gw	functional

metadata-content-safety

Schema-legitimate free-text metadata fields cannot be blanked without breaking a valid SIDD product, so a smuggled string (an external URI, a printf format specifier, a prototype-pollution key name or a Unicode bidi/zero-width control) survives CDR byte-for-byte. Genesis never dereferences or interprets these values, so there is no in-process exploit; the residual is covert-channel carriage and downstream-consumer risk. Detecting them keeps a carrier file from being reported fully clean, and the opt-in removals excise the smuggled substring while preserving the surrounding field text.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
bidi-control-present	gw-JAVH938	Detect Unicode bidirectional or zero-width format controls in free-text product metadata	report	report remove omit	gw; analogy	functional
external-uri-present	gw-ZD2XT8E	Detect an external URI or network reference (http/https/ftp/file scheme or UNC path) in free-text product metadata	report	report remove omit	gw	functional
format-specifier-present	gw-3KATT09	Detect potential printf-style format specifiers (for example %n or %s) in free-text product metadata	report	report remove omit	gw	functional
prototype-pollution-token-present	gw-YKTE7V9	Detect potential JavaScript prototype-pollution key names (for example proto or constructor.prototype) in free-text product metadata	report	report omit	gw	functional

nitf-cross-validation

Mismatches between SIDD XML metadata and NITF header fields indicate structural tampering, potential security marking spillage or deliberate parser confusion attacks. A marking divergence is spillage in either direction: a reader that honors the container ignores what the XML declares, and a reader that honors the XML ignores what the container declares.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
compartment-marking-undeclared	gw-GBF3505	Detect a NITF codeword field asserting a compartment the SIDD XML does not declare	report	report omit	gw	functional
declassification-marking-undeclared	gw-1J738J1	Detect a NITF declassification date the SIDD XML does not declare in any form	report	report omit	gw	functional
declassification-nitf-mismatch	gw-3MY6B2A	Detect SIDD declassification instructions that disagree with the NITF declassification fields	reject	report omit	spec; gw	functional
des-count-inconsistent	gw-TMKRTBS	Detect a NUMDES in the NITF file header inconsistent with the actual DES segment count	report	report omit	spec; gw	functional
dimension-column-inconsistent	gw-PRS36KR	Detect a PixelFootprint/Col inconsistent with the NITF image segment NCOLS	report	report omit	spec; gw	functional
dimension-row-inconsistent	gw-7AH5PH7	Detect a PixelFootprint/Row inconsistent with the NITF image segment NROWS	report	report omit	spec; gw	functional
dissemination-nitf-mismatch	gw-PXE61YD	Detect a NITF releasability field that releases content the SIDD XML marks NOFORN	reject	report omit	spec; gw	functional
file-classification-mismatch	gw-N9THCGY	Detect a SIDD classification that does not match the NITF file-level security classification	reject	report omit	spec; gw	functional
image-category-invalid	gw-81R2SR5	Detect a NITF ICAT other than 'SAR' or an appropriate value for SAR-derived imagery	report	report omit	spec; gw	functional
multiple-sidd-des	gw-K357JJK	Detect other than exactly one SIDD XML DES per image product	report	report omit	spec; gw	functional
segment-classification-mismatch	gw-Z6R16QY	Detect a NITF segment subheader classification inconsistent with the SIDD product classification	reject	report omit	spec; gw	functional

product-creation

Oversized string fields in ProductCreation can be used for data hiding. Invalid processing timestamps could indicate tampering.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
processing-datetime-invalid	gw-NTS4689	Detect a ProcessorInformation/ProcessingDateTime that is not a valid ISO 8601 datetime	report	report omit	spec; gw	functional
processor-application-invalid	gw-6XP7AG2	Detect a ProcessorInformation/Application that is empty or longer than 256 characters	report	report omit	spec; gw	functional
processor-site-invalid	gw-V81NDY1	Detect a ProcessorInformation/Site longer than 256 characters	report	report omit	spec; gw	functional
product-class-invalid	gw-89F9CAM	Detect a ProductClass that is empty or longer than 256 characters	report	report omit	spec; gw	functional
product-name-invalid	gw-5Y8411V	Detect a ProductName that is empty or longer than 1024 characters	report	report omit	spec; gw	functional
product-type-invalid	gw-2FX9F0C	Detect a ProductType longer than 256 characters	report	report omit	spec; gw	functional

product-processing

Excessive processing module chains can indicate data smuggling. Oversized module names can carry hidden data.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
module-count-invalid	gw-FSS7ZY4	Detect a processing module count exceeding 100	report	report omit	spec; gw	functional
module-name-invalid	gw-3QTTNJA	Detect a ProcessingModule/ModuleName that is empty or longer than 256 characters	report	report omit	spec; gw	functional

required-elements

Missing required elements indicate a malformed or truncated SIDD document that could confuse downstream processors or bypass validation.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
display-missing	gw-YYXY3FQ	Detect a Display element that is missing or empty	report	report omit	spec; gw	functional
exploitation-features-missing	gw-X7P4QMA	Detect an ExploitationFeatures element that is missing or empty	report	report omit	spec; gw	functional
geo-data-missing	gw-JMB6FZD	Detect a GeoData element that is missing or empty	report	report omit	spec; gw	functional
measurement-missing	gw-49WNGHS	Detect a Measurement element that is missing or empty	report	report omit	spec; gw	functional
product-creation-missing	gw-K82V8TN	Detect a ProductCreation element that is missing or empty	report	report omit	spec; gw	functional
sidd-root-invalid	gw-AR9HBBZ	Detect a root element other than 'SIDD' with a valid namespace	report	report omit	spec; gw	functional

schema-coverage

A SIDD that violates the XSD occurrence / choice / enumeration constraints is self-inconsistent: a duplicate of a singleton element, more than one projection choice or an out-of-range enumerated value can drive divergent interpretations across downstream consumers - a parser-differential surface.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
choice-violation	gw-Z4853N6	Detect more than one branch of an xs:choice group present under the same parent	report	report omit	spec; gw	structural
declared-count-mismatch	gw-4TQZP8N	Detect a declared count attribute that disagrees with the elements it describes	replace	replace report omit	spec; gw	structural
duplicate-element	gw-7SSCTKS	Detect a SIDD element that appears more times under its parent than the schema permits	report	report omit	spec; gw	structural
enumeration-value-invalid	gw-8XGWSFV	Detect a closed-enumeration SIDD element carrying a value outside its schema value space	report	report omit	spec; gw	structural
non-finite-number-present	gw-7QGFGQB	Detect a NaN or infinite value in a field whose schema type admits it	report	report remove omit	gw; analogy	functional
numeric-value-invalid	gw-W2DGXB2	Detect a numeric value outside the value space its schema type declares	reject	report omit	spec; gw; analogy	structural
polynomial-order-mismatch	gw-9BVK37X	Detect polynomial coefficients that contradict the order the polynomial declares	report	report omit	spec; gw	structural

xml-structure

DOCTYPE declarations enable XXE injection (SSRF, file disclosure, DoS). Processing instructions can load external resources. CDATA sections and comments can smuggle hidden data. Namespace redirection can point to attacker-controlled schemas.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
cdata-sections-present	gw-6KC9E6R	Detect CDATA sections that may carry smuggled content	replace	replace report omit	gw	structural
extension-attributes-present	gw-FHWD2DE	Detect non-schema attributes on known SIDD elements	remove	remove report omit	gw	structural
extra-namespaces-present	gw-G8Z6XZ4	Detect namespace declarations beyond the SIDD namespace	remove	remove report omit	gw	structural
namespace-uri-invalid	gw-K1EJW4D	Detect a root element namespace that is not a supported SIDD version (1.0.0 / 2.0.0 / 3.0.0)	report	report omit	spec; gw	structural
processing-instructions-present	gw-E823KNZ	Detect XML processing instructions other than the XML declaration	remove	remove report omit	gw	structural
unknown-elements-present	gw-DCSXWT0	Detect XML elements not defined in the SIDD schema	remove	remove report omit	gw	structural
xinclude-present	gw-DEV6W3G	Detect W3C XInclude directives in the SIDD XML—DOCTYPE-independent external file inclusion / SSRF	remove	remove report omit	gw	structural
xml-comments-present	gw-VEW0J03	Detect XML comments that may carry covert-channel hidden data	remove	remove report omit	gw	structural
xml-doctype-present	gw-F4XE4P0	Detect a DOCTYPE declaration in the SIDD XML (XXE injection vector)	reject	report omit	gw	structural
xml-null-bytes-present	gw-KR0ZCMW	Detect null bytes in SIDD XML string values	reject	report omit	gw	structural
xml-size-invalid	gw-CJ0YW13	Detect a total XML size exceeding 10 MB	reject	report omit	spec; gw	structural