A NITF or NSIF file can carry JPEG, JPEG 2000, EMF (Enhanced Metafile), WMF (Windows Metafile), H.264 and H.265 content and SIDD (Sensor Independent Derived Data) data extension segments. Glasswall Genesis inspects each with the format's own rules, and you set the action for any of them in the `extendedFormatSettings` section of a content management policy under `overrides.<format>`, where the format is one of `jpeg`, `jpeg2000`, `emf`, `wmf`, `h264`, `h265` or `sidd`. See [Configuring NITF and NSIF protection](/halo/configuring-nitf-nsif-protection) for the section itself and the rules for the NITF structure.

These rules apply only to content inside a NITF or NSIF file. A standalone file of one of these formats is not processed by Genesis.

Each rule is listed with its name and ID, either of which can be used as a key under `rules`. `reject` is offered by every rule and is not repeated in the **Configurable actions** column. **Compliance** lists the sources that back the rule: `spec` is the format specification, `isg` is the NSA Inspection and Sanitization Guidance, `cve` is a published vulnerability, `gw` is Glasswall research. **Impact** is the rule's change tier.


## JPEG (`jpeg`)

### `app0-jfif-marker-segment`

A buffer overflow data attack may occur if 'JFIF' is a non-zero terminated string. Unknown versions may contain different or more data that is unprocessed by applications. The thumbnail data is uncompressed RGB data and must be exactly 3 \* width \* height bytes or data may be hidden.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `jfif-app0-segment` | `gw-2ASADSX` | Detect a JFIF APP0 marker segment present in the file | `remove` | `remove` `report` `omit` | isg; gw | visual |
| `jfif-density-units` | `gw-AJNQQKZ` | Detect a JFIF APP0 density unit that is not 0, 1 or 2 | `report` | `report` `replace` `omit` | spec; isg; gw | structural |
| `jfif-identifier-null-terminated` | `gw-DCA7TQN` | Detect a JFIF APP0 identifier that is not a zero-terminated 'JFIF' string | `report` | `report` `replace` `omit` | spec; isg; gw | structural |
| `jfif-thumbnail-data-size` | `gw-CM50D74` | Detect JFIF APP0 thumbnail data whose size is not exactly 3 \* Xthumbnail \* Ythumbnail bytes | `report` | `report` `omit` | spec; isg; gw | structural |
| `jfif-version` | `gw-P9PFBMN` | Detect a JFIF APP0 version other than 1.02 | `report` | `report` `omit` | spec; isg; gw | structural |

### `app0-thumbnail-image`

The image of the file and the thumbnail are not required to be of the same image. Data disclosure or data hiding are risks if the encoded image and thumbnail image are different. The thumbnail may reveal content not visible in the main image, or may be a different image entirely, resulting in inadvertent data disclosure.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `jfif-thumbnail` | `gw-V395XX2` | Detect an uncompressed thumbnail image embedded in the JFIF APP0 marker segment | `remove` | `remove` `replace` `report` `omit` | isg; gw | visual |

### `application-marker-segments`

Application developers can decide how to use an application marker segment. Any type of data may be placed in an application marker segment allowing for data hiding, data disclosure and data attack concerns.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `adobe-colour-transform-marker` | `gw-HQW0PNP` | Detect the Adobe APP14 color-transform marker on a four-component (CMYK/YCCK) image, where it is the sole color-space declaration | `replace` | `replace` `remove` `report` `omit` | isg; gw | visual |
| `all-application-markers` | `gw-9R5YGRR` | Detect APP0-APP15 application marker segments that may carry arbitrary application-defined data | `remove` | `remove` `report` `omit` | isg; gw | functional |
| `application-marker-content` | `gw-KDKSD11` | Detect identifiable data types within application marker segments (text strings, JFIF thumbnail images, Exif metadata) that require external filtering | `report` | `report` `omit` | isg; gw | functional |
| `unapproved-application-markers` | `gw-6PQEBBP` | Detect application marker segments that are not on the approved application marker segment list | `remove` | `remove` `report` `omit` | isg; gw | functional |

### `comment-marker-segments`

Any data may be stored in a COM marker segment. Data hiding is possible since arbitrary data can be purposefully placed in the comment marker segment. Comments may contain information not intended for distribution, resulting in inadvertent data disclosure.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `comment-markers` | `gw-12TH0XN` | Detect COM (comment) marker segments that may carry arbitrary text, metadata or hidden content | `remove` | `remove` `replace` `report` `omit` | isg; gw | visual |

### `content-identity`

A foreign container mis-identified as JPEG by its extension (e.g. a DjVu named .jpg, the CVE-2021-22204 delivery vector) is forwarded unchanged by a fail-open passthrough, and different downstream consumers route it to different parsers (a parser-differential / identification-divergence smuggling channel). An identified-but-unsupported JPEG subformat left unrecognized would be unrouted, so a container would pass it through untouched (a CDR bypass), while attempting to remediate it as baseline T.81 would corrupt it. Refusing the mis-identified or unsupported file closes the divergence so validate and protect agree, and no non-JPEG file or undecodable JPEG variant is delivered under a JPEG name.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `foreign-container-magic` | `gw-AZCDPHB` | Detect a file presented as JPEG whose leading magic bytes identify a different, recognized container format, or that has no recoverable JPEG SOI (start-of-image) marker | `reject` | — | cve; gw | structural |
| `t851-arithmetic-extension-unsupported` | `gw-T851GAP` | Detect a file that opens with the ITU-T T.851 JPG file-identifier (FF C8 00 05 'ac2'), an arithmetic-coding extension Genesis cannot decode | `reject` | `report` `omit` | spec; gw | structural |

### `dependent-marker-segments`

The presence of a dependent marker segment without the marker segment which is depended upon, or with an out-of-spec conditioning / expansion value, may indicate data hiding or a corrupted JPEG image and steers decoders apart.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `dac-conditioning-valid` | `gw-DACB6X1` | Detect an arithmetic conditioning (DAC) segment whose Tc/Tb/Cs value-space is out of spec (Table B.6) | `reject` | `report` `omit` | spec; isg; gw | structural |
| `dependent-differential-frame-requires-dhp` | `gw-HPDDJY6` | Detect a differential frame header present without a required DHP marker segment | `reject` | `report` `omit` | spec; isg; gw | structural |
| `exp-expand-geometry-valid` | `gw-EXPB3X1` | Detect an EXP (expand reference components) segment whose length or Eh/Ev expansion nibble geometry is out of spec | `reject` | `report` `omit` | spec; isg; gw | structural |
| `exp-requires-dhp` | `gw-KJTS9J6` | Detect an EXP marker segment present without a required DHP marker segment | `reject` | `report` `omit` | spec; isg; gw | structural |
| `rst-requires-dri` | `gw-M73DZRW` | Detect an RST marker segment present without a required DRI marker segment | `reject` | `report` `omit` | spec; isg; gw | structural |
| `tem-requires-arithmetic-frame` | `gw-5T4XVWA` | Detect a TEM marker segment present without a required arithmetic coding frame | `reject` | `report` `omit` | spec; isg; gw | structural |

### `entropy-coded-image-data`

Known steganography tools manipulate the DCT coefficients by embedding information within the entropy coded image data. The most popular method is to use the least significant bits (LSBs) of the DCT coefficients. If a binary program were located within or completely replaced the entropy coded image data, attempting to process the image can be a data attack.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `dct-coefficient-lsb-steganography` | `gw-SXBGNFH` | Detect potential steganography in the least significant bits (LSBs) of the DCT coefficients | `report` | `report` `replace` `omit` | isg; gw | visual |
| `entropy-data-executable-scan` | `gw-18VPVCF` | Detect known executable signatures within entropy coded segments | `report` | `report` `omit` | isg; gw | structural |
| `entropy-data-recompress` | `gw-MVE59CW` | Detect entropy coded image data that may conceal hidden data recoverable by decompression and lossy recompression | `report` | `report` `replace` `omit` | isg; gw | visual |
| `entropy-stream-decodable` | `gw-KWJMMG4` | Detect an entropy coded stream or Huffman tables that fail a full decode, indicating a malformed or inconsistent codestream | `report` | `report` `omit` | spec; isg; gw | structural |

### `exif-app-marker`

Exif markers can add any kind of data that TIFF supports making it a high risk for data hiding. Since a processing application must use a TIFF parser to parse the contents, an attacker could use a vulnerability in the TIFF parser. The TIFF may also include a thumbnail. Exif metadata may contain camera details, geolocation data, timestamps and other information not intended for distribution, resulting in inadvertent data disclosure.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `exif-identifier-null-terminated` | `gw-56BJWZS` | Detect an Exif APP marker identifier that is not zero terminated with an additional zero byte of padding | `report` | `report` `omit` | spec; isg; gw | structural |
| `exif-marker` | `gw-J0R5DWV` | Detect an Exif APP1 marker segment present in the file | `remove` | `remove` `report` `omit` | isg; gw | functional |
| `jfif-exif-exclusivity` | `gw-RFGTYGQ` | Detect both a JFIF APP marker and an Exif APP marker present when only one is permitted | `report` | `report` `omit` | spec; isg; gw | structural |
| `single-exif-marker` | `gw-HX687SE` | Detect more than one Exif APP marker present in the file | `report` | `report` `omit` | spec; isg; gw | structural |

### `frame-header`

A malformed frame header (missing component parameters) may cause a JPEG decoder to crash or malicious code to run. If there are more lines in the decompressed image than the Number of lines parameter, viewers will truncate the image data, hiding additional image content from the user.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `extraneous-frame-lines` | `gw-8RQE1ZF` | Detect extraneous bytes exceeding the Number of lines parameter | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `frame-component-count` | `gw-C141K8G` | Detect a frame header Number of components parameter that disagrees with the count of component parameters present | `reject` | `report` `omit` | spec; isg; gw | structural |
| `frame-deep-precision` | `gw-JQ7VK2M` | Detect a coding frame declaring a sample precision above 8 bits (12-bit or 16-bit deep precision)—the decoder-attack shape behind CVE-2023-2804 (12-bit h2v2 merged upsample). Genesis's managed 8-bit codec cannot normalize deep-precision samples, so such a file is otherwise forwarded unremediated; reject it rather than passing a live trigger to a downstream native decoder. | `reject` | `report` `omit` | cve; gw | structural |
| `frame-header-well-formed` | `gw-FHCJBZN` | Detect a frame header (SOF) with an out-of-range sample precision, component sampling factor or quantization-table selector; a sampling-factor sum (Σ Hi×Vi) exceeding 10; or a quantization-table selector that resolves to no defined DQT | `reject` | `report` `omit` | spec; gw | structural |
| `frame-line-count` | `gw-3E3NGX1` | Detect a frame header Number-of-lines (Y) = 0 with no DNL marker segment to define the image height, an undefined-height header decoders resolve divergently | `reject` | `report` `omit` | spec; isg; gw | structural |

### `frames`

An image with more than one frame may be at risk of data hiding. Non-differential frames are stand-alone images; if more than one non-differential frame is present, data hiding may exist as unseen images. Hierarchical images are not well supported in open source libraries or commercial tools. A frame encoded with a codec or subformat Genesis cannot fully decode and re-encode (arithmetic, lossless, high-precision, JPEG-LS or an abbreviated / frameless stream) would otherwise be copied through uninspected as an alternate-codec hidden-content channel.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `dhp-precedes-differential-frame` | `gw-JTZQCSA` | Detect a first differential frame that is not preceded by a DHP marker segment | `reject` | `report` `omit` | spec; isg; gw | structural |
| `differential-frame-requires-dhp` | `gw-HJM58AJ` | Detect differential frames present without a DHP marker segment | `reject` | `report` `omit` | spec; isg; gw | structural |
| `hierarchical-image` | `gw-PD7MA5Y` | Detect a hierarchical image, an uncommon structure that can be restructured into a baseline JFIF image | `replace` | `replace` `report` `omit` | isg; gw | visual |
| `single-non-differential-frame` | `gw-NYG94BW` | Detect more than one non-differential frame in the image | `reject` | `report` `omit` | spec; isg; gw | structural |
| `unsupported-codec-mode` | `gw-2K9XTR4` | Detect a JPEG codec or subformat Genesis cannot fully decode and re-encode (arithmetic coding SOF9/10/11/13/14/15, lossless SOF3/7/11/15, sample precision above 8 bits, JPEG-LS SOF55/LSE or an abbreviated / frameless stream) whose entropy codestream would otherwise be copied through uninspected | `reject` | `report` `omit` | spec; isg; gw | structural |

### `icc-profile`

An ICC profile is an embedded object adhering to an independent data format. Its data disclosure, hiding and attack risks must be subjected to the same level of scrutiny as the JFIF file that contains it. The ICC profile may contain metadata revealing information about the color processing pipeline or device characteristics not intended for distribution.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `icc-profile-present` | `gw-QXZH1S2` | Detect an ICC profile embedded in an APP2 marker segment | `remove` | `remove` `replace` `report` `omit` | isg; gw | visual |
| `icc-profile-valid` | `gw-SE1YSAZ` | Detect an ICC profile that does not conform to the ICC format specification | `report` | `report` `omit` | spec; isg; gw | structural |

### `image-boundaries`

The length between SOI and EOI markers is unconstrained; extra bytes may exist between markers and marker segments allowing data hiding. Data after the EOI is typically ignored by decoders and represents hidden data.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `data-after-eoi` | `gw-EZVBV08` | Detect data present after the EOI marker | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `data-before-soi` | `gw-DZHDRQ7` | Detect data present before the SOI marker | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `eoi-last` | `gw-Y1R85SA` | Detect a file whose final bytes are not the EOI marker | `reject` | — | spec; isg; gw | structural |
| `inter-marker-gaps` | `gw-RMYCGBT` | Detect extra bytes in the inter-marker gaps of the JFIF structure that could conceal hidden data, including the 0xFF fill bytes T.81 B.1.1.2 permits before a marker | `remove` | `remove` | isg; gw | structural |
| `markers-adjacent` | `gw-WK26XQE` | Detect a marker or marker segment between SOI and EOI that is not directly adjacent to another marker or marker segment | `reject` | `report` `omit` | spec; isg; gw | structural |
| `single-soi-eoi-pair` | `gw-MQS9694` | Detect more than one SOI marker or more than one EOI marker in the file | `reject` | — | spec; isg; gw | structural |
| `soi-first` | `gw-2YF03JJ` | Detect a file whose first bytes are not the SOI marker | `reject` | — | spec; isg; gw | structural |

### `jfif-extension-marker-segment`

A buffer overflow data attack may occur if 'JFXX' is a non-zero terminated string. An unknown extension type would allow a block of data not processed by viewers, representing a data hiding risk.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `jfxx-extension-code` | `gw-S1FVNV6` | Detect a JFXX extension code that is not one of 0x10 (JPEG thumbnail), 0x11 (1 byte/pixel) or 0x13 (3 bytes/pixel) | `report` | `report` `omit` | spec; isg; gw | structural |
| `jfxx-identifier-null-terminated` | `gw-P4ETZVG` | Detect a JFXX APP0 identifier that is not a zero-terminated 'JFXX' string | `report` | `report` `replace` `omit` | spec; isg; gw | structural |
| `jfxx-segment` | `gw-BCPK0QF` | Detect a JFXX extension APP0 marker segment present in the file | `remove` | `remove` `report` `omit` | isg; gw | visual |
| `jfxx-unknown-extension` | `gw-C9D4GR1` | Detect a JFXX extension segment whose extension code is not of a known type | `remove` | `remove` `report` `omit` | isg; gw | visual |

### `jfif-extension-thumbnail-image`

The image of the file and the thumbnail are not required to be of the same image. Data hiding is a risk if the encoded image and thumbnail differ. There may be thumbnail data in both JFIF and JFXX markers and applications may use either or neither of them. The extension thumbnail may reveal content not visible in the main image, or may be a different image entirely, resulting in inadvertent data disclosure.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `jfxx-thumbnail` | `gw-M379C48` | Detect a thumbnail image embedded in the JFXX extension APP0 marker segment | `remove` | `remove` `replace` `report` `omit` | isg; gw | visual |
| `jfxx-thumbnail-no-jfif-markers` | `gw-QVJ4K2A` | Detect JFIF markers present within the JFXX extension thumbnail image | `report` | `report` `omit` | spec; isg; gw | structural |

### `marker-segment-length`

If the length specified is an invalid value (less than two or past the EOI) processing this marker segment is vulnerable to a data attack, possibly redirecting the processing application to an arbitrary address in memory resulting in a system crash or buffer overflow.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `marker-segment-length` | `gw-TF472H9` | Detect a marker segment length that is out of range or extends past the EOI marker | `reject` | `report` `omit` | spec; isg; gw | structural |

### `marker-values-and-order`

An invalid marker indicates that the image file is malformed or corrupted and may indicate a data attack by causing the processing application to hang or crash.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `marker-order` | `gw-CXQ98NF` | Detect JPEG markers appearing out of the spec-defined order | `reject` | `report` `omit` | spec; isg; gw | structural |
| `stray-ff00-outside-segment` | `gw-GFWYRSY` | Detect the hexadecimal value 0xFF00 appearing outside a marker segment or an entropy-coded segment | `reject` | `report` `omit` | spec; isg; gw | structural |
| `stray-ffff-outside-segment` | `gw-5B8BMAT` | Detect the hexadecimal value 0xFFFF appearing outside a marker segment | `reject` | `report` `omit` | spec; isg; gw | structural |

### `nxpowerlite-app-marker`

As with all APP markers there is potential for data hiding, data disclosure and data attack. The NXPowerLite APP marker currently only includes an integer; however, there is no guarantee that the software will not expand the field in the future.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `nxpl-identifier-null-terminated` | `gw-GX2FH62` | Detect an NXPL APP marker identifier that is not zero terminated | `report` | `report` `omit` | spec; isg; gw | structural |
| `nxpl-length` | `gw-PDYPBXG` | Detect an NXPL APP marker whose length is not 8 | `report` | `report` `omit` | spec; isg; gw | structural |
| `nxpl-marker` | `gw-ZH4F77C` | Detect an NXPowerLite (NXPL) APP marker segment present in the file | `remove` | `remove` `report` `omit` | isg; gw | functional |
| `nxpl-position` | `gw-TW0GRJM` | Detect an NXPL APP marker in an inappropriate position (before SOI, after EOI or as the first APP marker) | `report` | `report` `omit` | spec; isg; gw | structural |
| `single-nxpl-marker` | `gw-FNGPFXF` | Detect more than one NXPL APP marker present in the file | `report` | `report` `omit` | spec; isg; gw | structural |

### `reserved-marker-segments`

The presence of a reserved marker segment may indicate data hiding. Their structure has not been specified in ISO/IEC 10918-1 and they are reserved for future revisions.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `reserved-markers` | `gw-5T26D9F` | Detect reserved marker segments (RES, JPG, JPGn) whose structure is unspecified | `remove` | `remove` `report` `omit` | isg; gw | structural |

### `scan-header`

A malformed scan header that may cause a JPEG decoder to crash and malicious code to run is considered a data attack.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `scan-component-count` | `gw-QGVMNKV` | Detect a scan header Number of components parameter that disagrees with the count of component parameters present | `reject` | `report` `omit` | spec; isg; gw | structural |
| `scan-header-spec` | `gw-ZX68W7B` | Detect scan header (SOS) parameters that do not conform to the JPEG specification | `reject` | `report` `omit` | spec; isg; gw | structural |
| `scan-header-well-formed` | `gw-RQ86VQG` | Detect a scan header (SOS) with an out-of-range entropy-table selector or successive-approximation bit position; a component count (Ns) disagreeing with the frame's (Nf) for a single sequential scan; a component selector (Cs) or entropy-table selector (Td/Ta) that resolves to no defined frame component or Huffman table | `reject` | `report` `omit` | spec; isg; gw | structural |

### `scans`

Progressive processed frames contain multiple scans. The decoder may skip low-resolution scans and only display the high-resolution image. The presence of multiple scans is a data hiding risk. Converting to baseline does not sufficiently mitigate the issue since the selected scan could contain hidden data.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `progressive-multi-scan` | `gw-G2NR75A` | Detect a progressive image with multiple scans that can be flattened to a single-scan baseline JFIF image | `replace` | `replace` `report` `omit` | isg; gw | visual |
| `single-scan` | `gw-39E0PYX` | Detect an image containing more than one scan | `report` | `report` `omit` | spec; isg; gw | structural |

### `tables`

Tables defined in a DQT, DHT or DAC segment but never referenced by a SOF or SOS segment are a data hiding risk.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `huffman-table-well-formed` | `gw-RWEBY34` | Detect a Huffman table (DHT) with an out-of-range table class or destination selector, or whose code lengths overflow its marker segment | `reject` | `report` `omit` | spec; isg; gw | structural |
| `quantization-table-well-formed` | `gw-757NHSY` | Detect a quantization table (DQT) with an out-of-range element precision or destination selector, or whose definition overflows its marker segment | `reject` | `report` `omit` | spec; isg; gw | structural |
| `unreferenced-tables` | `gw-GYJ2B1C` | Detect table marker segments (DQT, DHT, DAC) that are never referenced by a SOF or SOS segment | `remove` | `remove` `report` `omit` | isg; gw | structural |

## JPEG 2000 (`jpeg2000`)

### `binary-filter-box`

Contents of transformed data cannot be determined without decompressing or decrypting, posing data hiding and attack risks.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `binary-filter-box-present` | `gw-1GVB1CK` | Detect a Binary Filter box present in the file | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `binary-filter-undecodable-invalid` | `gw-KPTW5DV` | Detect Binary Filter box data that cannot be successfully decompressed or decrypted | `report` | `report` `omit` | spec; isg; gw | structural |
| `binary-filter-uuid-invalid` | `gw-QQDM1RK` | Detect a Binary Filter box whose UUID field is not one of the two specified values (GZIP or DES) | `report` | `report` `omit` | spec; isg; gw | structural |

### `box-general`

Self-reported box lengths enable data hiding and covert channels. Readers may ignore unknown boxes while retaining hidden data. Buffer overflow risk from unbounded lengths.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `box-identifier-invalid` | `gw-65M3SWR` | Detect a box carrying an identifier that is not valid per the specification (Tables 5-2 and 5-3) | `reject` | `remove` `report` `omit` | spec; isg; gw | structural |
| `box-length-exceeds-maximum` | `gw-A6FBVQ3` | Detect a box, with no specification-defined length bound, whose length exceeds a predefined maximum length value | `reject` | `remove` `report` `omit` | spec; isg; gw | structural |
| `box-length-out-of-range` | `gw-BFV17FZ` | Detect a box whose length violates the bounds the specification defines for its box type (e.g. Signature 12 bytes, Image Header 22 bytes, Capture Resolution 18 bytes, Default Display Resolution 18 bytes, Composition Options 17 bytes), including data extending beyond that bound | `reject` | `remove` `report` `omit` | spec; isg; gw | structural |
| `box-ordering-invalid` | `gw-CACTTGA` | Detect boxes whose ordering violates the specification (Signature first, Filetype second, Reader Requirements third, JP2 Header before Codestream) | `reject` | `report` `omit` | spec; isg; gw | structural |
| `box-unapproved-identifier-invalid` | `gw-D62Y0RX` | Detect a box carrying an identifier that is not on the approved list of box identifiers | `remove` | `remove` `report` `omit` | isg; gw | structural |

### `byte-aligned-segments`

RBAS can hold arbitrary amounts of data (data hiding risk). Long sequence of BAS or overly extended RBAS could crash reader application (data attack risk).

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `bas-excess-invalid` | `gw-CGFR80X` | Detect Byte Aligned Segments exceeding a predefined count threshold | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `bas-field-format-invalid` | `gw-EREHYB7` | Detect a Byte Aligned Segment whose data does not adhere to the format for its specific field | `report` | `report` `omit` | spec; isg; gw | structural |

### `data-entry-url-box`

Data hiding from post-null-termination data and buffer overflow risks from unbounded URL strings.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `url-box-not-in-uuid-info` | `gw-ATQ29AD` | Detect a Data Entry URL box that is not contained within a UUID Info box | `report` | `report` `omit` | spec; isg; gw | structural |
| `url-box-present` | `gw-4B0E6KS` | Detect a Data Entry URL box present in the file | `remove` | `remove` `replace` `report` `omit` | isg; gw | structural |
| `url-post-null-data-present` | `gw-K80BG5D` | Detect data following the null termination of the URL string | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `url-string-exceeds-maximum` | `gw-X6KD4GS` | Detect a Data Entry URL box URL string that is longer than a predefined length | `report` | `report` `omit` | spec; isg; gw | structural |
| `url-string-not-null-terminated` | `gw-2S3P2NH` | Detect a Data Entry URL box URL string that is not null-terminated | `report` | `report` `omit` | spec; isg; gw | structural |

### `digital-signature-box`

Reader may not have key management support to validate signature. Data hiding risk from unvalidated signatures.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `digital-signature-box-present` | `gw-R8Q4C1Y` | Detect a Digital Signature box present in the file | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `digital-signature-invalid` | `gw-XSGB37K` | Detect a Digital Signature box whose checksum or signature is invalid or whose payload has been modified | `report` | `report` `omit` | spec; isg; gw | structural |
| `digital-signature-unapproved-invalid` | `gw-K5T8ETD` | Detect a Digital Signature box using a digital signature (rather than a checksum) that is not on the approved list | `report` | `report` `omit` | spec; isg; gw | structural |

### `filetype-box`

Self-reported length enables covert channels. The compatibility list data field has no bounded length, posing data hiding risks.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `filetype-brand-invalid` | `gw-M3KXBDG` | Detect a Filetype box brand or compatibility list value outside the defined ISO-15444 set ('jp2\040', 'J2P0', 'J2P1') | `replace` | `replace` `report` `omit` | spec; isg; gw | structural |

### `free-box`

Free boxes are ignored by readers and pose a data hiding risk. Their contents are never displayed or processed.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `free-box-present` | `gw-HGDQ479` | Detect Free boxes present in the file | `remove` | `remove` `report` `omit` | isg; gw | structural |

### `icc-profile`

Embedded ICC profile is an independent format that requires the same scrutiny for data hiding and attack risks as the JPEG 2000 file.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `icc-profile-nonconforming` | `gw-QVSHRC2` | Detect an embedded ICC profile that does not conform to the ICC format specification | `report` | `report` `omit` | spec; isg; gw | structural |
| `icc-profile-present` | `gw-7AMJF0M` | Detect an ICC (International Color Consortium) profile embedded in the Color Specification box | `remove` | `remove` `replace` `report` `omit` | isg; gw | structural |

### `image-data`

Hidden data may be appended past the EOC (End of Codestream) marker, or carried in the least significant bits of the image samples that the format specification ignores.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `data-after-eoc-present` | `gw-ZFEVFCZ` | Detect data following the EOC (End of Codestream) marker | `remove` | `remove` `report` `omit` | spec; isg; gw | structural |
| `image-data-present` | `gw-N969SNC` | Detect an image codestream whose sample data can carry an LSB-hidden payload (a capability, not proof of a payload); a lossy or structural re-encode destroys the channel—this is a generic disarm, not steganalysis | `report` | `report` `replace` `omit` | isg; gw | visual |

### `jpsec-tools`

Use of confidentiality tool makes validation impossible without decryption password. Authentication tool poses data attack via URI. Certificate data is an avenue for attack.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `jpsec-authentication-invalid` | `gw-N1D5W00` | Detect a JPSEC Authentication Template (tool ID 2) whose data fails validation under the appropriate authentication method | `report` | `report` `omit` | spec; isg; gw | structural |
| `jpsec-encrypted-data-invalid` | `gw-CZ3XERD` | Detect a JPSEC Decryption Template (tool ID 1) indicating the data is encrypted | `reject` | `remove` `report` `omit` | spec; isg; gw | structural |
| `jpsec-hash-mismatch-invalid` | `gw-CEGREJP` | Detect a JPSEC tool (tool ID 3) whose recomputed hash does not match the stored hash for the specified data | `report` | `report` `omit` | spec; isg; gw | structural |

### `marker-segments`

Self-reported marker segment lengths enable data hiding. Array size values in marker segments may be manipulated to cause buffer overflows.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `marker-code-invalid` | `gw-XTQNRJ5` | Detect a marker segment carrying a code that is not valid | `report` | `report` `omit` | spec; isg; gw | structural |
| `marker-reserved-value` | `gw-ZJDFHXY` | Detect a marker segment body carrying a reserved-enumeration or out-of-range field that changes the decode and cannot be safely normalized | `reject` | `report` `omit` | spec; isg; gw | structural |
| `marker-reserved-bits` | `gw-E8P8S5F` | Detect a marker segment body carrying reserved bits (a covert channel a conformant decoder ignores) that can be cleared in place | `replace` | `report` `omit` | spec; isg; gw | structural |
| `marker-outside-codestream` | `gw-WFM5TS9` | Detect a marker segment that lies outside the codestream data | `report` | `report` `omit` | spec; isg; gw | structural |
| `marker-trailing-data-invalid` | `gw-DK50JWV` | Detect a reserved marker code or a marker segment carrying data beyond its specification-defined length bound | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `comment-marker-present` | `gw-3TMWET7` | Detect optional Comments (COM) marker segments | `remove` | `remove` `replace` `report` `omit` | isg; gw | structural |
| `unmodelled-marker-present` | `gw-MK7Q2P4` | Detect a codestream marker the engine does not model (a Part-2/15/17, JP3D, JPWL or otherwise-unrecognized extension marker, including CAP and PRF) whose body is copied through unvalidated | `report` | `remove` `omit` | isg; gw | structural |
| `in-packet-delimiter-inconsistent` | `gw-P9X4RT2` | Detect in-packet delimiter markers (SOP/EPH) inconsistent with the coding-style signaling or carrying a non-monotonic SOP sequence number (a covert channel) | `report` | `omit` | spec; isg; gw | structural |

### `media-data-box`

When data is not JPEG 2000 codestream, risks are the same as that data format and cannot be determined by the JPEG 2000 parser.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `media-data-noncodestream-invalid` | `gw-FAY8FQ6` | Detect Media Data box content that is not a valid codestream when the Fragment Table box specifies codestream data | `report` | `report` `omit` | spec; isg; gw | structural |
| `media-data-present` | `gw-8C8KQCJ` | Detect a Media Data box present in the file | `remove` | `remove` `report` `omit` | isg; gw | structural |

### `mpeg7-binary-box`

Box may be ignored by readers that do not support Motion JPEG 2000, posing data hiding risk.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `mpeg7-box-present` | `gw-ZDV72YM` | Detect an MPEG-7 Binary box present in the file | `remove` | `remove` `report` `omit` | isg; gw | structural |

### `multiple-codestreams`

No programmatic way to verify which codestream was intended for display. Additional codestreams may contain hidden data.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `jp2-multiple-codestreams-invalid` | `gw-2W3SXSA` | Detect JP2-formatted data carrying more than one codestream box | `remove` | `remove` `report` `omit` | spec; isg; gw | structural |

### `multiple-jpx-codestreams`

Each codestream in a JPX file is susceptible to the same data hiding and attack risks as individual codestreams (JPEG2000:8 through JPEG2000:11). See Section 5.3 recommendations.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `jpx-per-codestream-risks-invalid` | `gw-YX8FBFJ` | Detect a JPX file whose individual codestreams carry the same single-codestream risks (image data integrity, codestream count, resolution levels and steganography) | `report` | `report` `omit` | spec; isg; gw | structural |

### `reader-requirements-box`

Variable length Vendor Features list containing UUIDs may not be validated by readers, posing data hiding risk.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `vendor-features-present` | `gw-XV2AJGZ` | Detect Vendor Features information present in the Reader Requirements box | `remove` | `remove` `report` `omit` | isg; gw | structural |

### `resolution-levels`

Progressive resolution capability poses data disclosure risk. Sensitive data may be revealed at certain resolution levels that are not visible at the default display resolution.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `decomposition-levels-invalid` | `gw-F5CBETG` | Detect a codestream declaring more decomposition levels than the re-encode target, so higher-resolution detail can be removed or degraded by re-encoding | `report` | `report` `replace` `omit` | spec; isg; gw | visual |

### `signature-box`

Invalid signature values indicate non-valid JP2-formatted data. The Signature box is a fixed 12-byte box that must appear first.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `signature-error-check-invalid` | `gw-70YG6V7` | Detect a Signature box whose error-check field is not 0x0D0A870A (not applicable when data is JPC formatted) | `reject` | `report` `omit` | spec; isg; gw | structural |

### `uuid-box`

The UUID box data field has no bounds or format defined by the specification, posing data hiding and buffer overflow risks.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `uuid-box-present` | `gw-F3XESNT` | Detect a UUID box present in the file (its unbounded, format-undefined data field poses a data-hiding risk) | `remove` | `remove` `report` `omit` | isg; gw | structural |

### `xml-extended-metadata-box`

XML schemas are loose and support input flexibility, posing data hiding and attack risks from malformed or oversized XML.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `xml-box-present` | `gw-N76PVYR` | Detect XML boxes present in the file | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `xml-box-schema-invalid` | `gw-G9YJBG1` | Detect XML extended metadata box data that does not validate against its corresponding schema | `report` | `report` `replace` `omit` | spec; isg; gw | structural |

## EMF (`emf`)

### `bitmap-records`

Bitmap records embed DIB (Device Independent Bitmap) data with offsets and sizes that must be validated against the record boundary. Invalid BITMAPINFOHEADER fields (biWidth, biHeight, biBitCount, biSizeImage) can cause heap overflows. Unknown biCompression values may trigger codec vulnerabilities. Source rectangles outside the bitmap dimensions cause out-of-bounds reads. MaskBlt and PlgBlt records have additional bitmap payloads that multiply the attack surface. Embedded JPEG/PNG data must be passed to the appropriate sub-camera.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `bitmap-records-bounds` | `gw-YXAJ91A` | Detect bitmap record offsets or sizes that fall outside bounds | `report` | `report` `omit` | spec; gw | structural |
| `bitmap-records-compression-value` | `gw-QR9PQCV` | Detect a biCompression value outside the known set (BI_RGB, BI_RLE8, BI_RLE4, BI_BITFIELDS, BI_JPEG, BI_PNG) | `report` | `report` `omit` | spec; gw | structural |
| `bitmap-records-dib-header-size` | `gw-WRQVVJS` | Detect a DIB header size outside the known set (40 for BITMAPINFOHEADER, 108 for V4, 124 for V5) | `report` | `report` `omit` | spec; gw | structural |
| `bitmap-records-embedded-image-present` | `gw-JCNECCS` | Detect embedded raster image data (DIB, JPEG or PNG) carried in a bitmap record | `report` | `report` `omit` | gw | structural |

### `clipping-records`

Clipping records define regions that restrict rendering output. Invalid rectangle coordinates can cause integer overflow in region calculations. EMR_EXTSELECTCLIPRGN contains variable-length region data whose size must match the record. Unknown region mode values cause undefined clipping behavior.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `clipping-records-combine-mode-values` | `gw-HHZ0PHX` | Detect a region combining mode outside the known set (RGN_AND=1, RGN_OR=2, RGN_XOR=3, RGN_DIFF=4, RGN_COPY=5) | `report` | `report` `omit` | spec; gw | structural |
| `clipping-records-region-size-overflow` | `gw-1D0K8BB` | Detect a region data size that exceeds the record boundary | `reject` | `report` `omit` | spec; gw | structural |

### `color-management`

Color management records can embed ICC profiles (large binary blobs with known parser vulnerabilities), reference external profile file paths (path traversal attacks) and configure ICM processing modes. Profile paths may disclose file system layout. ICC profile data must be size-validated and passed to a specialized handler. Color match to target can reference external files.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `color-management-color-match-target` | `gw-4GQGWZ2` | Detect EMR_COLORMATCHTOTARGET records that reference external target profiles | `remove` | `remove` `report` `omit` | gw | functional |
| `color-management-external-paths` | `gw-DXVQX5Q` | Detect external ICC profile file path references | `reject` | `report` `omit` | spec; gw | functional |
| `color-management-icc-data-embedded` | `gw-62FG7VC` | Detect embedded ICC profile data that requires content validation by an external ICC profile handler | `report` | `report` `omit` | gw | structural |
| `color-management-icc-size-overflow` | `gw-TADPC50` | Detect an embedded ICC profile size that exceeds the record boundary | `reject` | `report` `omit` | spec; gw | structural |
| `color-management-icm-mode` | `gw-THDC56V` | Detect an ICM mode enabling color management processing | `replace` | `replace` `report` `omit` | gw | functional |
| `color-management-logcolorspace-values` | `gw-NETK0ZR` | Detect a LOGCOLORSPACE colorspace type or intent outside the known set | `report` | `report` `omit` | spec; gw | structural |
| `color-management-profile-paths` | `gw-E2W6WWT` | Detect file path references in EMR_SETICMPROFILEA and EMR_SETICMPROFILEW records | `remove` | `remove` `report` `omit` | gw | functional |
| `color-management-structure` | `gw-RF27NV8` | Detect color management records whose structure is malformed | `report` | `report` `omit` | spec; gw | structural |

### `comment-records`

EMF comment records are the primary vector for embedded content and data hiding. EMR_COMMENT_EMFPLUS embeds GDI+ instructions that constitute a second instruction stream. EMR_COMMENT_EMFSPOOL contains printer spool commands that may run with elevated privileges. Generic comments can hide arbitrary data. EMR_COMMENT_MULTIFORMATS can embed WMF, EMF or other format data. Unbalanced EMF+ groups cause resource leaks. The data size field must be validated against the record boundary.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `comment-records-data-size-within-record` | `gw-PB0BVMG` | Detect a comment data size (cbData) that is inconsistent with the record size (nSize - 12) | `report` | `report` `omit` | spec; gw | structural |
| `comment-records-embedded-content-present` | `gw-NCPARA4` | Detect embedded EMF+ or WMF content carried in a comment record | `report` | `report` `omit` | gw | functional |
| `comment-records-emfplus-nested-sizes` | `gw-W6VWJPN` | Detect EMF+ record sizes within comment data that are inconsistent or exceed the comment boundary | `report` | `report` `omit` | spec; gw | structural |
| `comment-records-emfspool` | `gw-8KYVF1F` | Detect EMR_COMMENT_EMFSPOOL records carrying printer spool commands | `remove` | `remove` `report` `omit` | gw | functional |
| `comment-records-generic` | `gw-WP5DZF8` | Detect generic EMR_COMMENT records that match no known public comment identifier | `remove` | `remove` `report` `omit` | gw | functional |
| `comment-records-group-bracket-balance` | `gw-VVCJZNS` | Detect unbalanced GDICOMMENT_BEGINGROUP and GDICOMMENT_ENDGROUP records | `report` | `report` `omit` | spec; gw | structural |
| `comment-records-group-description` | `gw-5C7X3ZE` | Detect a GDICOMMENT_BEGINGROUP description string carrying arbitrary content | `replace` | `replace` `report` `omit` | gw | visual |
| `comment-records-group-unicode` | `gw-8TCM8EX` | Detect Unicode string data in a GDICOMMENT_BEGINGROUP description | `remove` | `remove` `report` `omit` | gw | visual |
| `comment-records-public-identifier-values` | `gw-FTHVS7Z` | Detect an EMR_COMMENT_PUBLIC identifier outside the known set (GDICOMMENT_BEGINGROUP, GDICOMMENT_ENDGROUP, GDICOMMENT_MULTIFORMATS, GDICOMMENT_WINDOWS_METAFILE, GDICOMMENT_IDENTIFIER) | `report` | `report` `omit` | spec; gw | structural |
| `comment-records-structure` | `gw-6N43FB8` | Detect comment records whose structure or content bounds are malformed | `report` | `report` `omit` | spec; gw | structural |
| `comment-records-unknown-identifiers` | `gw-PE12CQX` | Detect comment records with unknown identifiers | `reject` | `report` `omit` | spec; gw | structural |

### `control-records`

EMR_EOF marks the end of the metafile. Missing EOF records cause parsers to read beyond valid data. Multiple EOF records can hide content between them. The SizeLast field enables reverse traversal; an incorrect value can mislead backwards-walking parsers. Palette data in the EOF record must be validated.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `control-records-eof-validation` | `gw-WVPY6JV` | Detect a missing EMR_EOF record at the end of the file | `report` | `report` `omit` | spec; gw | structural |
| `control-records-single-eof` | `gw-AATWFC6` | Detect more than one EMR_EOF record | `reject` | `report` `omit` | spec; gw | structural |
| `control-records-sizelast` | `gw-WWT4G6G` | Detect a SizeLast field that no longer matches the EMR_EOF record nSize after remediation | `replace` | `replace` `report` `omit` | gw | structural |

### `dc-save-restore`

EMR_SAVEDC pushes device context state onto a stack; EMR_RESTOREDC pops it. Unbalanced operations cause stack underflow (crash) or resource exhaustion (DoS via deep stack). The nRelSaveDC parameter in RestoreDC specifies how many levels to pop; negative values relative to current depth must be validated.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `dc-save-restore-stack-underflow` | `gw-ND0EVT5` | Detect an EMR_RESTOREDC that would underflow the device context stack | `reject` | `report` `omit` | spec; gw | structural |

### `drawing-records`

Drawing records contain variable-length point arrays. Integer overflow in point count multiplication (count \* sizeof(POINT)) can cause heap buffer overflows. PolyPolygon records have nested counts that must sum correctly. Extreme coordinate values can trigger integer overflow in rendering pipelines. Unknown vertex types in PolyDraw records cause undefined behavior.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `drawing-records-point-count-consistency` | `gw-TGMWVPP` | Detect point counts in polygon/polyline records that are inconsistent with the record size | `report` | `report` `omit` | spec; gw | structural |
| `drawing-records-point-count-maximum` | `gw-A2PCC19` | Detect point counts that exceed a safe maximum for memory allocation | `reject` | `report` `omit` | spec; gw | structural |
| `drawing-records-point-counts` | `gw-GNAA5P4` | Detect malformed point array counts in drawing records | `report` | `report` `omit` | spec; gw | structural |
| `drawing-records-polydraw-vertex-types` | `gw-9BRNJM6` | Detect PolyDraw vertex type bytes outside the known set (PT_LINETO, PT_BEZIERTO, PT_MOVETO, PT_CLOSEFIGURE) | `reject` | `report` `omit` | spec; gw | structural |

### `emf-header`

The EMR_HEADER defines the entire metafile's coordinate space, object table size and embedded description. Malformed signatures bypass format detection. Invalid bounds or frame rectangles can cause integer overflows in rendering. Zero device dimensions cause division-by-zero in coordinate transforms. The description string offset/length may read beyond the record. Reserved fields may hide data.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `emf-header-bounds` | `gw-ZMY4P8V` | Detect an inconsistent EMF header bounding box | `reject` | `report` `omit` | spec; gw | structural |
| `emf-header-description-bounds` | `gw-ZN2R964` | Detect an EMF header description string that falls outside its bounds | `report` | `report` `omit` | spec; gw | visual |
| `emf-header-handle-count-nonzero` | `gw-9CA8C3K` | Detect a handle count that is zero or outside a reasonable range | `report` | `report` `omit` | spec; gw | structural |
| `emf-header-record-count` | `gw-1J3YAHX` | Detect an EMF header record count that does not match the actual record count | `report` | `report` `omit` | spec; gw | structural |
| `emf-header-record-count-nonzero` | `gw-63W1NDG` | Detect a declared record count that is zero or exceeds file size divided by minimum record size | `report` | `report` `omit` | spec; gw | structural |
| `emf-header-record-type` | `gw-4YJ7BWG` | Detect a first record type that is not EMR_HEADER (0x00000001) | `report` | `report` `omit` | spec; gw | structural |
| `emf-header-rectangles-valid` | `gw-AM0QY5K` | Detect a degenerate header bounding box or frame rectangle (right&lt;left or bottom&lt;top, excluding the empty-rectangle sentinel) | `report` | `report` `omit` | spec; gw | structural |
| `emf-header-reserved-field` | `gw-C2J4RW1` | Detect a non-zero reserved field in the EMR_HEADER | `replace` | `replace` `report` `omit` | gw | structural |
| `emf-header-signature` | `gw-PRSC5J8` | Detect an EMF header signature that is not the expected value | `reject` | `report` `omit` | spec; gw | structural |
| `emf-header-size` | `gw-CW9XYNG` | Detect an inconsistent EMF header record size | `report` | `report` `omit` | spec; gw | structural |
| `emf-header-size-range` | `gw-HWM3GTT` | Detect a header record size (nSize) below 88 bytes or exceeding nBytes | `report` | `report` `omit` | spec; gw | structural |
| `emf-header-version` | `gw-AC0XHXM` | Detect an EMF header version that is not 0x00010000 | `reject` | `report` `omit` | spec; gw | structural |

### `emfplus-records`

EMF+ records embed a second, parallel instruction stream inside EMR_COMMENT_EMFPLUS envelopes. Individual record types carry inner-field lengths (StringLength, Count, SubregionCount) whose declared value can exceed the record DataSize, producing the same 'header smaller than payload' memory-corruption shape as the outer EMF layer. Windows GDI+ has been exploited through EmfPlusDrawString string-length corruption (CVE-2021-1665), EmfPlusFillRects / EmfPlusSetTSClip rectangle-count mismatch (CVE-2025-30388) and EmfPlusDrawRects bitmap-scan overflow (CVE-2025-53766). EmfPlusComment records (MS-EMFPLUS §2.3.2.1) are the main place a steganography tool can hide a payload, as proof-of-concept tooling has shown. The `record-structure` rules catch gross boundary violations in the outer EMF record headers; the four bounds rules below check the inner fields of individual EMF+ records, and `emfplus-records-comment-present` flags EmfPlusComment payloads that remain when the operator has turned off their removal.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `emfplus-records-comment-present` | `gw-T8GNHA9` | Detect an EmfPlusComment record (type 0x4003) with non-empty Data, a location for arbitrary operator-defined steganography payload bytes | `report` | `report` `omit` | spec; gw | functional |
| `emfplus-records-drawrects-bounds` | `gw-XPHRC8Y` | Detect an EmfPlusDrawRects record (type 0x400B) where Count \* 16 + 8 exceeds DataSize, an undersized RectData array relative to the declared Count | `reject` | `report` `omit` | spec; cve; gw | structural |
| `emfplus-records-drawstring-bounds` | `gw-3058EXV` | Detect an EmfPlusDrawString record (type 0x401C) where StringLength \* 2 + 28 exceeds DataSize, a declared string length beyond the available payload | `reject` | `report` `omit` | spec; cve; gw | structural |
| `emfplus-records-fillrects-bounds` | `gw-HJ83H5C` | Detect an EmfPlusFillRects record (type 0x400A) where Count \* 16 + 8 exceeds DataSize, an undersized RectData array relative to the declared Count | `reject` | `report` `omit` | spec; cve; gw | structural |
| `emfplus-records-settsclip-bounds` | `gw-5KTMHVM` | Detect an EmfPlusSetTSClip record (type 0x403A) where the Count field (Flags low 13 bits) times the per-rectangle size (16 bytes, or 8 when Flags bit 15 is set) exceeds DataSize | `reject` | `report` `omit` | spec; cve; gw | structural |
| `emfplus-records-stream-embedded` | `gw-AXAVXKC` | Detect a preserved EMF+ record stream that requires downstream semantic validation | `report` | `report` `omit` | gw | functional |

### `escape-records`

Escape records pass arbitrary data directly to device drivers, bypassing GDI rendering. EMR_DRAWESCAPE and EMR_EXTESCAPE can inject PostScript commands (CVE-style attacks). Named escapes reference driver-specific features. These records are the most dangerous attack vector in EMF files and should be removed or rejected in high-security environments.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `escape-records-data` | `gw-VY6C67X` | Detect escape data payload carried in escape records | `remove` | `remove` `report` `omit` | gw | functional |
| `escape-records-data-size-within-record` | `gw-80W79RC` | Detect an escape data size that is inconsistent with the record size | `report` | `report` `omit` | spec; gw | structural |
| `escape-records-draw` | `gw-VCN7T7D` | Detect EMR_DRAWESCAPE records | `remove` | `remove` `report` `omit` | cve; gw | functional |
| `escape-records-ext` | `gw-5PWVXBY` | Detect EMR_EXTESCAPE records | `remove` | `remove` `report` `omit` | gw | functional |
| `escape-records-function-code-values` | `gw-CMC46PD` | Detect an escape function code (iEscape) outside the known set | `report` | `report` `omit` | spec; gw | functional |
| `escape-records-named` | `gw-9TM3WJ2` | Detect EMR_NAMEDESCAPE records | `remove` | `remove` `report` `omit` | gw | functional |
| `escape-records-postscript` | `gw-BMNWEYZ` | Detect PostScript escape codes (POSTSCRIPT_DATA, POSTSCRIPT_PASSTHROUGH, ENCAPSULATED_POSTSCRIPT) | `reject` | `report` `omit` | gw | functional |
| `escape-records-record-count` | `gw-V043DJZ` | Detect a header record count that no longer matches the record chain after escape record removal | `replace` | `replace` `report` `omit` | gw | structural |
| `escape-records-structure` | `gw-N3D55AH` | Detect escape records whose structure is malformed | `report` | `report` `omit` | spec; gw | functional |

### `file-structure`

Malformed file sizes can trigger buffer overflows or out-of-bounds reads in parsers. Oversized declarations may cause excessive memory allocation (DoS). Files smaller than the minimum EMF header size cannot be valid. Bytes after the EMR_EOF record are not rendered and are an ideal location for data hiding (embedded executables, steganographic content or an alternate appended file format).

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `file-structure-declared-exceeds-actual` | `gw-MKDTPMY` | Detect a declared size that exceeds the actual file size, indicating a truncated or corrupted file | `reject` | `report` `omit` | spec; gw | structural |
| `file-structure-declared-size` | `gw-BYQCP09` | Detect a declared file size (nBytes in EMR_HEADER) that does not match the actual file size | `report` | `report` `omit` | spec; gw | structural |
| `file-structure-integrity` | `gw-60ADQXP` | Detect a malformed EMF file structure across the record chain, sizes and offsets | `reject` | `report` `omit` | spec; gw | structural |
| `file-structure-minimum-size` | `gw-X1K4DH4` | Detect an actual file size below the minimum EMF size (88 bytes for the header record) | `reject` | `report` `omit` | spec; gw | structural |
| `trailing-data` | `gw-XG1XNQT` | Detect bytes following the EMR_EOF record | `remove` | `remove` `report` `omit` | gw | structural |

### `font-embedding`

Font embedding records reference Universal Font Identifiers (UFIs) and design vectors for font matching. Variable-length UFI arrays and design vector data can overflow record boundaries. Linked UFIs reference external font resources. Force UFI mapping can bypass normal font substitution, potentially loading malicious fonts.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `font-embedding-force-ufi-mapping` | `gw-0EWSQ6W` | Detect EMR_FORCEUFIMAPPING records that bypass normal font substitution | `remove` | `remove` `report` `omit` | gw | functional |
| `font-embedding-linked-ufis` | `gw-WA2R2VJ` | Detect linked UFI references that point to external font resources | `remove` | `remove` `report` `omit` | gw | functional |
| `font-embedding-size-overflow` | `gw-GFEE1CY` | Detect a UFI count or design vector data that exceeds the record boundary | `reject` | `report` `omit` | spec; gw | structural |
| `font-embedding-structure` | `gw-M76MQHX` | Detect font embedding records whose structure is malformed | `report` | `report` `omit` | spec; gw | functional |

### `object-creation`

EMF maintains an object handle table sized by nHandles in the header. Out-of-range handle indices cause array overflows. Selecting or deleting unoccupied handles indicates corruption or attack. Extended pen styles with custom dash patterns have variable-length arrays. Font face names can contain path traversal or null-injection attacks. Brush styles may reference embedded DIB data.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `object-creation-bounds` | `gw-HACAJSC` | Detect object creation record offsets, sizes or handle limits that fall outside bounds | `report` | `report` `omit` | spec; gw | structural |
| `object-creation-brush-style-values` | `gw-2ZSJTYN` | Detect a brush style value outside the known set (BS_SOLID, BS_NULL, BS_HATCHED, BS_PATTERN, BS_DIBPATTERN, BS_DIBPATTERNPT) | `report` | `report` `omit` | spec; gw | structural |
| `object-creation-handle-occupied` | `gw-G47ZJGD` | Detect an EMR_SELECTOBJECT that references an empty handle slot that is not a stock object | `report` | `report` `omit` | spec; gw | structural |
| `object-creation-index-range` | `gw-2F2KDKS` | Detect an object handle index outside the range [0, nHandles-1] | `reject` | `report` `omit` | spec; gw | structural |
| `object-creation-pen-style-entry-count` | `gw-7A44FQQ` | Detect a custom dash pattern entry that is zero or an array count that is inconsistent with the record size | `report` | `report` `omit` | spec; gw | structural |
| `object-creation-pen-style-values` | `gw-QMFQ354` | Detect a pen style value outside the known set (PS_SOLID, PS_DASH, PS_DOT, PS_DASHDOT, PS_DASHDOTDOT, PS_NULL, PS_INSIDEFRAME, PS_USERSTYLE, PS_ALTERNATE) | `report` | `report` `omit` | spec; gw | structural |

### `opengl-records`

OpenGL records embed GLS (Graphics Library Stream) command data that is passed directly to the OpenGL driver. These records can run arbitrary GPU commands and are extremely dangerous. The bOpenGL flag in the header extension indicates OpenGL content presence. GLS data sizes must be validated. These records should be removed in security-conscious environments.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `opengl-records` | `gw-NZQ93Z5` | Detect EMR_GLSRECORD or EMR_GLSBOUNDEDRECORD records | `reject` | `report` `omit` | gw | functional |
| `opengl-records-bopengl` | `gw-5AWYS9Z` | Detect a bOpenGL flag set in the EMR_HEADER extension | `replace` | `replace` `report` `omit` | gw | functional |
| `opengl-records-data-size-within-record` | `gw-807THD6` | Detect a GLS data size (cbData) that is inconsistent with the record size | `report` | `report` `omit` | spec; gw | structural |
| `opengl-records-gls` | `gw-EXQEG4H` | Detect EMR_GLSRECORD records carrying GLS command streams | `remove` | `remove` `report` `omit` | gw | functional |
| `opengl-records-gls-bounded` | `gw-D3HK0EV` | Detect EMR_GLSBOUNDEDRECORD records carrying bounded GLS data with rendering bounds | `remove` | `remove` `report` `omit` | gw | functional |
| `opengl-records-structure` | `gw-1ZYS9DZ` | Detect OpenGL records whose presence or structure is malformed | `report` | `report` `omit` | spec; gw | functional |

### `palette-records`

Palette records contain variable-length entry arrays. Integer overflow in entry count multiplication can cause heap buffer overflows. The LOGPALETTE version must be 0x0300. Palette entry flags must be known values. ResizePalette can expand the palette beyond reasonable limits, causing excessive memory allocation.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `palette-records-entry-count-consistency` | `gw-8Y2KA66` | Detect a palette entry count that is inconsistent with the record size (cEntries \* 4 exceeds available data) | `report` | `report` `omit` | spec; gw | structural |
| `palette-records-resize-maximum-count` | `gw-M4NKQST` | Detect an EMR_RESIZEPALETTE entry count that exceeds the safe maximum (65536) | `report` | `report` `omit` | spec; gw | structural |
| `palette-records-structure` | `gw-WAGHMK9` | Detect palette records whose structure is malformed | `report` | `report` `omit` | spec; gw | structural |
| `palette-records-version-and-flags` | `gw-TC0BVJ8` | Detect a LOGPALETTE version that is not 0x0300 or a palette entry flag outside the known set (0, PC_EXPLICIT, PC_NOCOLLAPSE, PC_RESERVED) | `report` | `report` `omit` | spec; gw | structural |

### `path-records`

Path brackets (BeginPath/EndPath) define GDI path construction regions. Unbalanced brackets can cause resource leaks or undefined state in renderers. Path control records (CloseFigure, FlattenPath, etc.) have fixed sizes; excess bytes may hide data.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `path-records-exact-size` | `gw-VEWNTD8` | Detect a path control record (BeginPath, EndPath, CloseFigure, FlattenPath, WidenPath, AbortPath) whose size is not the fixed 8 bytes | `report` | `report` `omit` | spec; gw | structural |
| `path-records-padding` | `gw-DZVCMJC` | Detect padding bytes beyond the expected 8-byte size in path control records | `replace` | `replace` `report` `omit` | gw | structural |

### `pixel-format`

Pixel format records configure OpenGL rendering surface properties. The PIXELFORMATDESCRIPTOR contains flags that enable hardware acceleration and overlay planes. Invalid nSize values can cause buffer overreads. These records are only meaningful for OpenGL-enabled metafiles and should be removed when OpenGL records are stripped.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `pixel-format-descriptor-exact-size` | `gw-MFJE1R1` | Detect a PIXELFORMATDESCRIPTOR nSize that is not the expected 40 bytes | `report` | `report` `omit` | spec; gw | structural |
| `pixel-format-descriptor-size-within-record` | `gw-KX60V7F` | Detect PIXELFORMATDESCRIPTOR data that does not fit within the record boundary | `report` | `report` `omit` | spec; gw | structural |
| `pixel-format-flags-values` | `gw-5HRH82X` | Detect pixel format flags, type or layer type outside the known set | `report` | `report` `omit` | spec; gw | functional |
| `pixel-format-setpixelformat` | `gw-JZASEAB` | Detect EMR_SETPIXELFORMAT records | `remove` | `remove` `report` `omit` | gw | functional |
| `pixel-format-structure` | `gw-6VSSRCA` | Detect pixel format records whose structure is malformed | `report` | `report` `omit` | spec; gw | functional |

### `post-cdr-validation`

Remediation may produce a structurally invalid EMF that fails to render.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `post-cdr-validation-round-trip` | `gw-TVKJRGP` | Detect a post-CDR output file that does not re-parse as a valid EMF with EMR_HEADER first and EMR_EOF last | `report` | `report` `omit` | gw | structural |

### `record-structure`

Each EMF record begins with a type and size. Undersized records cause buffer under-reads. Non-aligned sizes break sequential parsing. Mismatched record counts indicate hidden or missing records. Unknown record types may trigger undefined behavior in renderers. Cyclical size references can cause infinite loops.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `record-extends-beyond-file` | `gw-NM70VFR` | Detect a record whose declared offset and size extend beyond the end of the file | `reject` | `report` `omit` | spec; gw | structural |
| `record-structure-alignment` | `gw-K24WEXR` | Detect a record size that is not DWORD-aligned (not a multiple of 4) | `report` | `report` `omit` | spec; gw | structural |
| `record-structure-minimum-size` | `gw-FK3PPSP` | Detect a record size below 8 bytes (the minimum for iType + nSize) | `report` | `report` `omit` | spec; gw | structural |
| `record-structure-minimum-size-per-type` | `gw-89NZX53` | Detect a record smaller than the minimum size for its type | `reject` | `report` `omit` | spec; gw | structural |
| `record-structure-padding` | `gw-J6ACZYR` | Detect padding bytes within DWORD-aligned record sizes | `replace` | `replace` `report` `omit` | gw | structural |
| `record-structure-unknown-types` | `gw-99GKXR5` | Detect unknown or undefined record types | `reject` | `report` `omit` | spec; gw | structural |
| `record-structure-validation` | `gw-5EEYH6F` | Detect a malformed internal record structure (type, size, data alignment) | `reject` | `report` `omit` | spec; gw | structural |

### `state-records`

State records configure the device context rendering parameters. Invalid map mode values cause undefined coordinate transforms. Unknown enum values in SetBkMode, SetPolyFillMode, SetROP2, SetStretchBltMode and SetTextAlign can trigger undefined behavior. Records larger than the minimum required size may contain hidden data in padding bytes. Extreme miter limit values can cause rendering anomalies.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `state-records-enum-values` | `gw-HR0G5QD` | Detect an enum value in SetBkMode, SetPolyFillMode, SetROP2, SetStretchBltMode or SetTextAlign outside the known set | `report` | `report` `omit` | spec; gw | structural |
| `state-records-exact-size` | `gw-PZYXTD7` | Detect a state record size that does not match the expected size for its record type (typically 12 bytes) | `report` | `report` `omit` | spec; gw | structural |
| `state-records-map-mode` | `gw-4E0NKHJ` | Detect an unknown map mode or enum value in state records | `reject` | `report` `omit` | spec; gw | structural |
| `state-records-padding` | `gw-RKRRSXT` | Detect padding bytes in state records beyond their expected minimum size | `replace` | `replace` `report` `omit` | gw | structural |

### `text-records`

Text records contain variable-length strings with offsets that must fall within the record boundary. The inter-character spacing (Dx) array size must match the character count. Integer overflow in offset + length calculations can cause out-of-bounds reads. SmallTextOut has a compact encoding with different validation requirements. Text content itself may contain sensitive information.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `text-records-char-count-consistency` | `gw-BWGDKC2` | Detect a character count that is inconsistent with the available record data size | `report` | `report` `omit` | spec; gw | structural |
| `text-records-content-embedded` | `gw-2SQ5ZPT` | Detect embedded text content that requires content inspection by an external text handler | `report` | `report` `omit` | gw | visual |
| `text-records-options-flags` | `gw-GXK0HJV` | Detect text output option flags outside the known set (ETO_OPAQUE, ETO_CLIPPED, ETO_GLYPH_INDEX, ETO_RTLREADING, ETO_PDY) | `report` | `report` `omit` | spec; gw | structural |

### `transform-records`

World transform matrices control all coordinate mapping. NaN or Infinity values in matrix elements cause undefined rendering behavior and may crash renderers. A zero determinant (eM11\*eM22 - eM12\*eM21 = 0) makes the transform non-invertible, causing failures in hit-testing and reverse transforms. Zero extent transforms collapse all output to a single point.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `transform-records-nan-identity` | `gw-QQYXVER` | Detect NaN or Infinity values in transform matrix elements | `report` | `report` `omit` | gw | structural |

## WMF (`wmf`)

### `bitmap-records`

Bitmap records are the second-highest risk category in WMF. Buffer overflow exploits (CVE-2005-2123, CVE-2005-2124, CVE-2008-3015) exploit inconsistencies between record size and bitmap parameters. Integer overflow in size calculations can be triggered by negative or zero dimensions, or non-standard bit depths. Out-of-bounds reads occur when declared biSizeImage exceeds actual pixel data (CVE-2017-0190). Source-dependent raster operations with no embedded bitmap cause null pointer dereference.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `bitmap-dib-compression` | `gw-R6VDAQK` | Detect a biCompression value that is not a known DIB compression (BI_RGB=0, BI_RLE8=1, BI_RLE4=2, BI_BITFIELDS=3) | `report` | `report` `omit` | spec; gw | structural |
| `bitmap-dib-dimensions` | `gw-N3A66T9` | Detect DIB header fields outside valid ranges (biWidth &lt;= 0, biHeight == 0 or biBitCount not in &#123;1, 4, 8, 16, 24, 32&#125;) | `report` | `report` `omit` | spec; gw | structural |
| `bitmap-dib-size-image` | `gw-Y5F1SS5` | Detect a biSizeImage inconsistent with biWidth \* biHeight \* (biBitCount/8) accounting for row padding | `report` | `report` `omit` | spec; cve; gw | structural |
| `bitmap-embedded-dib` | `gw-EJ5EWPK` | Detect an embedded DIB bitmap that requires deep inspection by an image data handler | `report` | `report` `omit` | gw | structural |
| `bitmap-raster-op-source` | `gw-39XMF0Y` | Detect a RasterOperation that references a source when no bitmap is present in the record | `report` | `report` `omit` | spec; gw | structural |
| `bitmap-record-size-consistency` | `gw-D9FPV4D` | Detect a RecordSize inconsistent with the declared bitmap dimensions, bit depth and compression | `report` | `report` `omit` | spec; gw | structural |
| `bitmap-source-rect-bounds` | `gw-WKFF2N4` | Detect source coordinates (XSrc, YSrc, SrcWidth, SrcHeight) that exceed the DIB dimensions | `report` | `report` `omit` | spec; gw | structural |

### `device-context`

Zero extent values cause division by zero in coordinate transforms. Restoring a non-existent DC level causes stack underflow. Unknown mapping modes cause undefined coordinate transform behavior.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `dc-map-mode` | `gw-KRV7DSS` | Detect a META_SETMAPMODE with a mode that is not a known value from the MapMode enumeration | `report` | `report` `omit` | spec; gw | structural |
| `dc-save-restore-balance` | `gw-6528Z1X` | Detect a META_RESTOREDC referencing a saved DC level that does not exist (unbalanced SAVEDC/RESTOREDC) | `report` | `report` `omit` | spec; gw | structural |
| `dc-viewport-extent` | `gw-508AXG9` | Detect a META_SETVIEWPORTEXT with a zero width or height | `report` | `report` `omit` | spec; gw | structural |
| `dc-window-extent` | `gw-2MGDNWH` | Detect a META_SETWINDOWEXT with a zero width or height | `report` | `report` `omit` | spec; gw | structural |

### `escape-records`

META_ESCAPE is the highest-risk record type in the WMF format. The infamous CVE-2005-4560 (SETABORTPROC) exploit used META_ESCAPE to achieve arbitrary code execution on all Windows versions. META_ESCAPE provides access to 50+ escape functions, many of which are printer-specific, capable of embedding arbitrary data or running arbitrary code. PostScript escapes inject arbitrary PostScript code. Passthrough escapes send raw data directly to the printer driver. Channel escapes open direct communication channels. MFCOMMENT embeds arbitrary binary data including full EMF files.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `escape-records-mfcomment` | `gw-E6WSFDQ` | Detect a META_ESCAPE record with EscapeFunction = MFCOMMENT (0x000F), which embeds arbitrary binary data as a comment (used to embed a full EMF file inside a WMF via META_ESCAPE_ENHANCED_METAFILE) | `remove` | `remove` `report` `omit` | gw | functional |
| `escape-records-postscript` | `gw-VMFW9F7` | Detect a META_ESCAPE record with a PostScript EscapeFunction: POSTSCRIPT_DATA (0x0025), POSTSCRIPT_PASSTHROUGH (0x1013), POSTSCRIPT_IDENTIFY (0x1005), POSTSCRIPT_INJECTION (0x1006) or ENCAPSULATED_POSTSCRIPT (0x1014) | `reject` | `report` `omit` | spec; gw | functional |
| `escape-records-present` | `gw-WPSAE8P` | Detect any META_ESCAPE record | `remove` | `remove` `report` `omit` | gw; advisory | functional |
| `escape-records-setabortproc` | `gw-Q9WR00P` | Detect a META_ESCAPE record with EscapeFunction = SETABORTPROC (0x0009) | `reject` | `report` `omit` | spec; cve; gw | functional |
| `escape-records-whitelist` | `gw-9N259FV` | Detect a META_ESCAPE record whose escape function code is outside the approved whitelist (currently empty: there is no known safe subset of GDI escape functions for document processing, so all escape functions including PASSTHROUGH, SPCLPASSTHROUGH2, OPEN_CHANNEL, CLOSE_CHANNEL and DOWNLOAD_HEADER are detected) | `reject` | `report` `omit` | spec; gw | functional |

### `font-records`

Unknown character sets may trigger undefined font mapper behavior. Non-terminated face names cause buffer over-read in font lookup. Extreme font dimensions can cause integer overflow in glyph rendering.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `font-char-set` | `gw-F0MZST3` | Detect a CharSet that is not a known value from the CharacterSet enumeration | `report` | `report` `omit` | spec; gw | structural |
| `font-dimension-bounds` | `gw-9M6P2TA` | Detect lfHeight or lfWidth outside reasonable bounds | `report` | `report` `omit` | spec; gw | structural |
| `font-face-name-disclosure` | `gw-WW5J3CM` | Detect a FaceName that may disclose sensitive information | `report` | `report` `omit` | spec; gw | visual |
| `font-face-name-termination` | `gw-Q63APBE` | Detect a FaceName that is not null-terminated within 32 bytes | `report` | `report` `omit` | spec; gw | structural |

### `meta-header`

Data attack risks exist if the file type, version or size fields are malformed. Size mismatch is a common indicator of appended data or truncation; exploits often set invalid sizes to confuse parsers (CVE-2007-1211). Oversized object tables can trigger excessive memory allocation. The NumberOfMembers field is unused and non-zero values may hide data.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `meta-header-file-size` | `gw-8P5G6WE` | Detect SizeLow/SizeHigh (total file size in WORDs) that disagrees with the actual file length | `report` | `report` `omit` | spec; gw | structural |
| `meta-header-gap-data` | `gw-5WXX0AR` | Detect data between the end of the placeable header (if present) and the start of META_HEADER | `report` | `report` `omit` | spec; gw | structural |
| `meta-header-invalid-type` | `gw-WMFT8RJ` | Detect a META_HEADER Type field that is not 0x0001 (memory) or 0x0002 (disk) | `reject` | `report` `omit` | spec; gw | structural |
| `meta-header-invalid-version` | `gw-WMFV9PK` | Detect a META_HEADER Version field that is not 0x0100 or 0x0300 | `reject` | `report` `omit` | spec; gw | structural |
| `meta-header-max-record` | `gw-FNK26NK` | Detect a MaxRecord value that exceeds the file size | `report` | `report` `omit` | spec; gw | structural |
| `meta-header-number-of-members` | `gw-Q06Z4KC` | Detect a non-zero NumberOfMembers field (unused per MS-WMF; non-zero values may hide data) | `replace` | `replace` `report` `omit` | gw | structural |
| `meta-header-number-of-objects` | `gw-A0Q1W9A` | Detect a NumberOfObjects that is unreasonable (e.g., &gt; 65535) or inconsistent with the actual object creation records in the stream | `report` | `report` `omit` | spec; gw | structural |

### `object-table`

Out-of-range object indices cause use of uninitialized memory or out-of-bounds table access. Double-free or deletion of non-existent objects causes heap corruption. Exceeding the object table causes heap overflow. Leaked objects may indicate incomplete record streams designed to exhaust resources.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `object-delete-index-valid` | `gw-VXVMFX2` | Detect a META_DELETEOBJECT index outside the range [0, NumberOfObjects) or referencing an unoccupied slot | `report` | `report` `omit` | spec; gw | structural |
| `object-lifecycle-complete` | `gw-PE3XQZV` | Detect created objects that are never deleted (leaked objects) | `report` | `report` `omit` | spec; gw | structural |
| `object-select-index-range` | `gw-9VHXCN6` | Detect a META_SELECTOBJECT index outside the range [0, NumberOfObjects) | `report` | `report` `omit` | spec; gw | structural |
| `object-table-overflow` | `gw-X2N72YY` | Detect objects created beyond the declared NumberOfObjects limit | `report` | `report` `omit` | spec; gw | structural |

### `palette-records`

Mismatch between NumberOfEntries and RecordSize causes buffer overflow when reading palette entries. Unknown palette entry flags may trigger undefined behavior. Excessive palette sizes can exhaust memory.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `palette-entry-count-consistency` | `gw-9Q8B8VR` | Detect a META_CREATEPALETTE whose NumberOfEntries is inconsistent with RecordSize | `report` | `report` `omit` | spec; gw | structural |
| `palette-entry-flags` | `gw-T7WN4CY` | Detect a palette entry PaletteEntryFlag value that is not a known flag (0x00, 0x01, 0x02, 0x04) | `report` | `report` `omit` | spec; gw | structural |
| `palette-resize-bounds` | `gw-9YV4QXG` | Detect a META_RESIZEPALETTE whose new size exceeds 65536 entries | `report` | `report` `omit` | spec; gw | structural |

### `placeable-header`

Data attack risks exist if the magic number is malformed, which may indicate format confusion attacks. Checksum mismatch indicates tampering or corruption. Inconsistent bounding box coordinates can trigger integer overflow in renderer dimension calculations. A zero resolution value causes division by zero in coordinate transforms. The reserved field must be zero; non-zero values may hide data.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `placeable-header-bounding-box` | `gw-DQ3FGNR` | Detect inconsistent BoundingBox coordinates (Left &gt; Right or Top &gt; Bottom) | `report` | `report` `omit` | spec; gw | structural |
| `placeable-header-checksum` | `gw-V13JQNH` | Detect a checksum field (XOR of the first 10 WORDs) that disagrees with the computed value | `report` | `report` `omit` | spec; gw | structural |
| `placeable-header-magic` | `gw-FXBGZ9Q` | Detect a placeable header magic number that is not 0x9AC6CDD7 | `report` | `report` `omit` | spec; gw | structural |
| `placeable-header-reserved` | `gw-EJKFWZW` | Detect a non-zero placeable header Reserved field (must be 0x00000000) | `replace` | `replace` `report` `omit` | gw | structural |
| `placeable-header-zero-inch` | `gw-MM7KR3Q` | Detect a placeable header Inch (resolution) field of 0 | `reject` | `report` `omit` | spec; gw | structural |

### `polygon-region-records`

Integer overflow in vertex count sums causes undersized buffer allocation followed by heap overflow (CVE-2006-2376, MS06-026). Mismatch between point counts and record size causes out-of-bounds read/write. Complex region data parsing has historically been vulnerable to buffer overflows. Extreme coordinates can cause integer overflow in rendering calculations.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `point-coordinate-bounds` | `gw-1ET88JS` | Detect point coordinates outside the declared bounding box or window extent | `report` | `report` `omit` | spec; gw | structural |
| `polygon-point-count-consistency` | `gw-K6HCSX1` | Detect a META_POLYGON/META_POLYLINE whose NumberOfPoints is inconsistent with RecordSize | `report` | `report` `omit` | spec; gw | structural |
| `polypolygon-vertex-overflow` | `gw-XVM0SW7` | Detect a META_POLYPOLYGON where the sum of all polygon vertex counts overflows a 32-bit integer | `report` | `report` `omit` | spec; cve; gw | structural |
| `region-data-consistency` | `gw-3WBPPQD` | Detect a META_CREATEREGION whose region data size is inconsistent with RecordSize or exceeds reasonable bounds | `report` | `report` `omit` | spec; gw | structural |

### `post-cdr-validation`

Remediation may produce a structurally invalid WMF that fails to render.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `post-cdr-round-trip` | `gw-D1E30S6` | Detect a protected WMF output that fails post-CDR round-trip re-parse (missing header, missing EOF record or otherwise structurally invalid) | `report` | `report` `omit` | gw | structural |

### `record-chain`

Records smaller than 3 WORDs are malformed and may cause infinite loops or negative seeks. Records extending past EOF cause out-of-bounds reads. Missing EOF indicates truncation; multiple EOFs indicate appended data. Oscillating record sizes are a known DoS pattern causing 100% CPU consumption. Trailing data after META_EOF can hide arbitrary payloads. Unknown record types indicate corruption, future format extensions or deliberate obfuscation.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `record-chain-cumulative-size` | `gw-BGJT8TN` | Detect cumulative record sizes that exceed the file length | `report` | `report` `omit` | spec; gw | structural |
| `record-chain-eof-present` | `gw-QG0STSW` | Detect data present after the META_EOF record | `remove` | `remove` `report` `omit` | gw | structural |
| `record-chain-known-types` | `gw-JKR9HW8` | Detect a RecordFunction value that is not a known value from the RecordType enumeration | `report` | `report` `omit` | spec; gw | structural |
| `record-chain-minimum-size` | `gw-DC19TTB` | Detect a record whose RecordSize is less than 3 WORDs (minimum: size + type fields) | `report` | `report` `omit` | spec; gw | structural |
| `record-chain-oscillating-sizes` | `gw-WGA0WR9` | Detect consecutive records whose sizes oscillate (e.g., +3/-3), a pattern that can create an infinite loop | `report` | `report` `omit` | spec; gw | structural |
| `record-chain-single-eof` | `gw-CMGQH2D` | Detect a record chain that does not terminate with exactly one META_EOF record | `report` | `report` `omit` | spec; gw | structural |
| `record-chain-trailing-data` | `gw-TAGY5R3` | Detect trailing data after the META_EOF record | `report` | `report` `omit` | spec; gw | structural |
| `record-chain-trailing-data-remove` | `gw-RPPAK3Y` | Detect trailing data after the META_EOF record that can be removed | `remove` | `remove` `report` `omit` | gw | structural |
| `record-chain-unknown-types` | `gw-05N7054` | Detect unknown/undocumented record types | `report` | `report` `omit` | spec; gw | structural |
| `record-chain-unknown-types-reject` | `gw-XE80ADG` | Detect unknown or unrecognized record types | `reject` | `report` `omit` | spec; gw | structural |

### `text-records`

String length exceeding available record data causes buffer over-read. Malformed clipping rectangles in META_EXTTEXTOUT can trigger integer overflow.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `text-clipping-rect-consistency` | `gw-YY1K9DW` | Detect a META_EXTTEXTOUT with an inconsistent optional clipping rectangle | `report` | `report` `omit` | spec; gw | structural |
| `text-content-disclosure` | `gw-T1VZ4RW` | Detect text content that may contain sensitive information | `report` | `report` `omit` | gw | visual |
| `text-string-length-consistency` | `gw-N98JZVC` | Detect a StringLength inconsistent with RecordSize | `report` | `report` `omit` | spec; gw | structural |

## H.264 (`h264`)

### `access-unit-delimiter`

AUD NAL units are structurally simple (1-byte payload); an oversized AUD could carry hidden data after the primary_pic_type field.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `aud-primary-pic-type-out-of-range` | `gw-AVFN14W` | Detect an AUD primary_pic_type outside the range 0-7 | `report` | `report` `omit` | spec; gw | structural |
| `aud-size-oversized` | `gw-SYYT35N` | Detect an AUD NAL unit whose RBSP size exceeds the expected 1 byte (primary_pic_type + trailing bits) | `report` | `report` `omit` | spec; gw | structural |

### `emulation-prevention`

Incorrect emulation prevention byte handling causes parser differentials and heap overflows; CVE-2024-22860 demonstrated a heap buffer overflow during RBSP decoding when emulation prevention bytes were incorrectly counted.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `emulation-prevention-byte-misplaced` | `gw-G5CCR9Z` | Detect an emulation prevention byte (0x03 after 0x0000) incorrectly placed per Annex B | `report` | `report` `omit` | spec; cve | structural |
| `emulation-prevention-invalid` | `gw-46P0V6P` | Detect RBSP data containing 0x000000, 0x000001 or 0x000002 without proper emulation prevention | `report` | `report` `omit` | spec; cve | structural |

### `filler-data`

Filler data NAL units are defined as 0xFF padding bytes for CBR rate control; modified byte values can carry steganographic content that is invisible to video playback but extractable by a receiver.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `filler-data-content-invalid` | `gw-RR9MRV1` | Detect a retained filler data NAL unit whose payload bytes are not all 0xFF | `report` | `report` `omit` | spec; gw | structural |
| `filler-nal-present` | `gw-VMERW3G` | Detect a filler data NAL unit (nal_unit_type 12) | `remove` | `remove` `report` `omit` | isg; gw | structural |

### `nal-header`

A set forbidden_zero_bit indicates a corrupt or crafted NAL unit; reserved and unspecified NAL unit types may be misinterpreted by different decoders (parser differential attacks) and can carry hidden data that no standard decoder processes; nal_ref_idc inconsistency with NAL type indicates structural corruption.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `forbidden-zero-bit-reject` | `gw-8HPWN2N` | Detect a NAL unit with forbidden_zero_bit set to 1 | `reject` | `report` `omit` | spec; isg; gw | structural |
| `forbidden-zero-bit-set` | `gw-K3PGXMZ` | Detect a NAL unit whose forbidden_zero_bit is set to 1 | `report` | `report` `omit` | spec; isg; gw | structural |
| `nal-ref-idc-nonzero-invalid` | `gw-W01HTMS` | Detect a non-zero nal_ref_idc on a NAL unit of type 6 (SEI), 9 (AUD), 10 (EOS), 11 (EOB) or 12 (filler) | `report` | `report` `omit` | spec; gw | structural |
| `nal-ref-idc-zero-invalid` | `gw-FBW21AF` | Detect a zero nal_ref_idc on a NAL unit of type 5 (IDR), 7 (SPS), 8 (PPS) or 15 (subset SPS) | `report` | `report` `omit` | spec; gw | structural |
| `nal-type-undefined` | `gw-GBVZ5RV` | Detect a nal_unit_type outside the range of defined types (1-12, 13-15, 19-21) | `report` | `report` `omit` | spec; gw | structural |
| `unspecified-nal-present` | `gw-43B38B1` | Detect an unspecified or reserved NAL unit (nal_unit_type 0, 22-23 or 24-31) | `remove` | `remove` `report` `omit` | isg; gw | structural |

### `pps-parameters`

PPS fields control reference picture list sizing for all slices that reference this PPS; crafted reference index override values cause heap overflow, and a PPS must reference a valid SPS.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `pps-id-out-of-range` | `gw-3D4Z9A2` | Detect a PPS pic_parameter_set_id outside the range 0-255 | `reject` | `report` `omit` | spec; gw | structural |
| `pps-ref-idx-exceeds-sps` | `gw-KR6Q75Q` | Detect a PPS num_ref_idx default value exceeding max_num_ref_frames from the referenced SPS | `reject` | `report` `omit` | spec; cve; gw | structural |
| `pps-ref-idx-l0-out-of-range` | `gw-ZYGJSX6` | Detect a PPS num_ref_idx_l0_default_active_minus1 outside the range 0-31 | `reject` | `report` `omit` | spec; cve; gw | structural |
| `pps-ref-idx-l1-out-of-range` | `gw-5JZDZSD` | Detect a PPS num_ref_idx_l1_default_active_minus1 outside the range 0-31 | `reject` | `report` `omit` | spec; cve; gw | structural |
| `pps-sps-cross-reference-invalid` | `gw-S058SQD` | Detect a PPS seq_parameter_set_id outside the range 0-31 or referencing no active SPS | `reject` | `report` `omit` | spec; cve; gw | structural |

### `sei-messages`

SEI payloadSize values exceeding the remaining NAL unit bytes trigger heap buffer overflows; user_data and filler SEI messages carry arbitrary payloads with no effect on decoded video and are the primary H.264 covert channels. Every other Annex D type carries attacker-chosen bytes a decoder does not read for reconstruction, so a type left unowned is a channel that no rule reports.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `sei-filler-payload` | `gw-1A104GK` | Detect a SEI message with payloadType 3 (filler_payload) | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `sei-hdr-metadata-present` | `gw-2NSWEE9` | Detect a mastering_display_colour_volume (payloadType 137) or content_light_level_info (payloadType 144) HDR metadata SEI message | `report` | `report` `omit` | gw | visual |
| `sei-non-essential-present` | `gw-0Z2GY6M` | Detect a SEI message of any Annex D payload type outside the named and retained sets | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `sei-payload-bounds-exceeded` | `gw-KY61VCZ` | Detect a SEI NAL unit whose payloadSize exceeds the NAL unit bounds | `reject` | `report` `omit` | spec; cve | structural |
| `sei-payload-size-out-of-bounds` | `gw-BVK66CA` | Detect a SEI message whose payloadSize exceeds the remaining bytes in the NAL unit RBSP | `report` | `report` `omit` | spec; cve | structural |
| `sei-total-size-out-of-bounds` | `gw-K3HQC38` | Detect total SEI message bytes exceeding the NAL unit size | `report` | `report` `omit` | spec; cve | structural |
| `sei-unknown-type` | `gw-XN7CVCK` | Detect a SEI message whose payloadType is not defined in ITU-T H.264 Annex D | `remove` | `remove` `report` `omit` | isg; gw | structural |
| `sei-user-data-registered` | `gw-2H0EDJ2` | Detect a SEI message with payloadType 4 (user_data_registered_itu_t_t35) | `remove` | `remove` `report` `omit` | isg; gw | functional |
| `sei-user-data-unregistered` | `gw-JCHWPW5` | Detect a SEI message with payloadType 5 (user_data_unregistered) | `remove` | `remove` `report` `omit` | isg; gw | functional |

### `slice-header`

Slice header fields reference PPS (which references SPS), creating a chain of dependent parameters; a crafted first_mb_in_slice exceeding frame dimensions causes out-of-bounds access, and crafted reference list reordering caused kernel RCE in Apple AVD.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `first-mb-out-of-range` | `gw-HYVERA1` | Detect a slice first_mb_in_slice outside the range 0 to (PicSizeInMbs - 1) | `report` | `report` `omit` | spec; cve | structural |
| `first-slice-not-idr` | `gw-3K4WVWD` | Detect a first coded slice in the stream that is not an IDR slice (nal_unit_type 5) | `report` | `report` `omit` | spec; gw | structural |
| `frame-num-out-of-range` | `gw-4NVAHAY` | Detect a slice frame_num outside the range 0 to (MaxFrameNum - 1) | `report` | `report` `omit` | spec | structural |
| `idr-pic-id-out-of-range` | `gw-260ZKYZ` | Detect an IDR slice idr_pic_id outside the range 0-65535 | `report` | `report` `omit` | spec | structural |
| `slice-pps-id-invalid` | `gw-BZBRFBM` | Detect a slice pic_parameter_set_id that references no active PPS | `report` | `report` `omit` | spec; cve | structural |
| `slice-type-out-of-range` | `gw-PP4FTQW` | Detect a slice slice_type outside the range 0-9 | `report` | `report` `omit` | spec | structural |

### `sps-parameters`

Crafted SPS dimension values cause integer overflow in width\*height multiplication, leading to small buffer allocation followed by large data writes; invalid profile/level, chroma, bit-depth and picture-order-count values trigger type confusion, incorrect buffer sizing, excessive allocation or infinite parsing loops in decoders.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `parameter-set-id-conflict` | `gw-NTMJK2S` | Detect two sequence parameter sets that share a seq_parameter_set_id while coding different pictures | `remove` | `remove` `report` `omit` | spec; gw | structural |
| `sps-bit-depth-chroma-out-of-range` | `gw-T9A6VRD` | Detect a SPS bit_depth_chroma_minus8 outside the range 0-6 | `reject` | `report` `omit` | spec; cve; gw | structural |
| `sps-bit-depth-luma-out-of-range` | `gw-X97P7K2` | Detect a SPS bit_depth_luma_minus8 outside the range 0-6 | `reject` | `report` `omit` | spec; cve; gw | structural |
| `sps-chroma-format-idc-out-of-range` | `gw-X3FZ7GD` | Detect a SPS chroma_format_idc outside the range 0-3 | `reject` | `report` `omit` | spec; cve; gw | structural |
| `sps-frame-size-excessive` | `gw-XXNGSJ8` | Detect a SPS whose computed frame size exceeds 8192x8192 or the level-defined MaxFS | `reject` | `report` `omit` | spec; cve; gw | structural |
| `sps-height-out-of-range` | `gw-MS67W3J` | Detect a SPS pic_height_in_map_units_minus1 that produces a frame height exceeding 8192 pixels | `reject` | `report` `omit` | spec; cve; gw | structural |
| `sps-id-out-of-range` | `gw-7WA5J83` | Detect a SPS seq_parameter_set_id outside the range 0-31 | `reject` | `report` `omit` | spec; gw | structural |
| `sps-level-idc-invalid` | `gw-7WYJ9FJ` | Detect a SPS level_idc that is not a recognized level value | `replace` | `replace` `report` `omit` | spec; gw | structural |
| `sps-log2-max-frame-num-out-of-range` | `gw-E58FF7V` | Detect a SPS log2_max_frame_num_minus4 outside the range 0-12 | `reject` | `report` `omit` | spec; gw | structural |
| `sps-log2-max-poc-lsb-out-of-range` | `gw-FVDEXJC` | Detect a SPS log2_max_pic_order_cnt_lsb_minus4 outside the range 0-12 | `reject` | `report` `omit` | spec; gw | structural |
| `sps-max-ref-frames-out-of-range` | `gw-GTV864C` | Detect a SPS max_num_ref_frames outside the range 0-16 | `reject` | `report` `omit` | spec; cve; gw | structural |
| `sps-num-ref-frames-poc-cycle-out-of-range` | `gw-66VC06C` | Detect a SPS num_ref_frames_in_pic_order_cnt_cycle outside the range 0-255 | `reject` | `report` `omit` | spec; cve; gw | structural |
| `sps-poc-type-out-of-range` | `gw-XY5HQ47` | Detect a SPS pic_order_cnt_type outside the range 0-2 | `reject` | `report` `omit` | spec; cve; gw | structural |
| `sps-profile-idc-invalid` | `gw-BZV39BG` | Detect a SPS profile_idc that is not a recognized profile value | `reject` | `report` `omit` | spec; cve; gw | structural |
| `sps-width-out-of-range` | `gw-XA4710M` | Detect a SPS pic_width_in_mbs_minus1 that produces a frame width exceeding 8192 pixels | `reject` | `report` `omit` | spec; cve; gw | structural |

### `stream-structure`

Malformed start codes cause parser differentials between Genesis and downstream decoders, enabling NAL unit smuggling; missing parameter sets before coded slices crash decoders; non-zero trailing data after the last NAL unit may carry hidden payloads.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `content-after-end-of-stream` | `gw-2FWMSS5` | Detect NAL units that follow the end_of_stream NAL unit | `remove` | `remove` `report` `omit` | spec; gw | structural |
| `leading-gap-content-present` | `gw-0G4F6XA` | Detect non-zero data before the first start code prefix | `remove` | `remove` `report` `omit` | spec; gw | structural |
| `nal-unit-absent` | `gw-EQ6N5A2` | Detect a byte stream containing no NAL units | `report` | `report` `omit` | spec; gw | structural |
| `pps-absent` | `gw-PKKFG5X` | Detect no PPS (nal_unit_type 8) present before the first coded slice | `report` | `report` `omit` | spec; gw | structural |
| `pps-sps-reference-invalid` | `gw-4ARH64Q` | Detect a PPS whose seq_parameter_set_id references no prior SPS | `report` | `report` `omit` | spec; gw | structural |
| `slice-pps-reference-invalid` | `gw-0H352A3` | Detect a coded slice whose pic_parameter_set_id references no prior PPS | `report` | `report` `omit` | spec; gw | structural |
| `sps-absent` | `gw-CQJQ3XA` | Detect no SPS (nal_unit_type 7) present before the first coded slice | `report` | `report` `omit` | spec; gw | structural |
| `start-code-invalid` | `gw-MGY5RG5` | Detect a NAL unit not preceded by a valid start code prefix (0x000001 or 0x00000001) | `report` | `report` `omit` | spec; gw | structural |
| `stream-start-invalid` | `gw-5ESKN84` | Detect a byte stream that does not begin with a start code prefix (leading non-zero data) | `report` | `report` `omit` | spec; gw | structural |
| `trailing-data-present` | `gw-QJ5262B` | Detect non-zero data present after the RBSP of the last NAL unit | `remove` | `remove` `report` `omit` | gw | structural |

## H.265 (`h265`)

### `filler-data`

Filler data NAL units and SEI payloads contain bytes ignored by decoders. They serve no content purpose and are a data-hiding channel.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `filler-nal-present` | `gw-W7EC4JN` | Detect a filler-data NAL unit (type 38) or filler SEI payload (payloadType 3) | `remove` | `remove` `report` `omit` | gw | structural |

### `nal-header`

Malformed NAL headers cause parser state corruption. The forbidden_zero_bit indicates corruption, invalid types trigger undefined behavior and a zero temporal_id causes decoder crashes.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `nal-forbidden-zero-bit-reject` | `gw-R87T8PN` | Detect a NAL unit with forbidden_zero_bit set to 1 that cannot be safely repaired | `reject` | `report` `omit` | spec; cve; gw | structural |
| `nal-layer-id-nonzero` | `gw-DCYF873` | Detect a NAL unit with nuh_layer_id not equal to 0 in a single-layer stream | `report` | `report` `omit` | spec; gw | functional |
| `nal-temporal-id-zero` | `gw-SF2WE2R` | Detect a NAL unit with nuh_temporal_id_plus1 equal to 0 (forbidden) | `report` | `report` `omit` | spec; gw | functional |
| `nal-type-out-of-range` | `gw-KR3C7QT` | Detect a NAL unit whose nal_unit_type is outside the 0-63 range | `report` | `report` `omit` | spec; gw | structural |
| `param-set-temporal-id-invalid` | `gw-DZ4K4SA` | Detect a VPS/SPS/PPS NAL unit whose nuh_temporal_id_plus1 is not 1 | `report` | `report` `omit` | spec; gw | functional |

### `nal-ordering`

Parameter sets must precede the NAL units that reference them. Out-of-order NAL units cause parser differentials between Genesis and the decoder, enabling bypass attacks.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `aud-ordering-invalid` | `gw-78RSSPB` | Detect an access-unit delimiter (type 35) not appearing first in its access unit | `report` | `report` `omit` | spec; gw | functional |
| `pps-after-slice` | `gw-59TX379` | Detect a PPS appearing after a slice that references it | `report` | `report` `omit` | spec; gw | functional |
| `sps-after-pps` | `gw-6WVFPJW` | Detect an SPS appearing after a PPS that references it | `report` | `report` `omit` | spec; gw | functional |
| `vps-after-sps` | `gw-PYQ5CXK` | Detect a VPS appearing after an SPS that references it | `report` | `report` `omit` | spec; gw | functional |

### `nal-type`

Reserved (10-15, 22-31, 41-47) and unspecified (48-63) NAL types carry no defined semantics and are data-hiding vectors; parsers handle them inconsistently, creating differential vulnerabilities. VCL NAL units that reference a missing PPS crash decoders.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `nal-type-defined-range-invalid` | `gw-2JY7HG7` | Detect a NAL unit whose nal_unit_type is outside the defined range 0-40 | `report` | `report` `omit` | spec; cve; gw | structural |
| `reserved-nal-present` | `gw-0QNEYJB` | Detect a NAL unit with a reserved type (10-15, 22-23, 24-31 or 41-47) | `remove` | `remove` `report` `omit` | cve; gw | structural |
| `unspecified-nal-present` | `gw-2K1QYQW` | Detect a NAL unit with an unspecified type (48-63) | `remove` | `remove` `report` `omit` | cve; gw | structural |
| `vcl-pps-reference-invalid` | `gw-KD50SB0` | Detect a VCL NAL unit (types 0-31) that does not reference a valid PPS | `report` | `report` `omit` | spec; gw | functional |

### `pps`

PPS must reference a valid SPS; invalid references cause uninitialized decoder state and parser crashes. Tile column/row counts control memory allocation for parallel decoding structures and crafted values cause heap buffer overflows (CVE-2020-21603); out-of-range reference counts and QP values cause array index violations.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `pps-absent` | `gw-J5Y57PX` | Detect a stream with no PPS NAL unit (type 34) present | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-cb-qp-offset-out-of-range` | `gw-7JW97K1` | Detect a pps_cb_qp_offset outside the range -12 to 12 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-cr-qp-offset-out-of-range` | `gw-9Z1CXQ9` | Detect a pps_cr_qp_offset outside the range -12 to 12 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-id-out-of-range` | `gw-GW6R3F1` | Detect a pps_pic_parameter_set_id outside the range 0-63 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-init-qp-out-of-range` | `gw-YD8QGST` | Detect an init_qp_minus26 outside the range -26 to 25 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-ref-idx-l0-out-of-range` | `gw-XX1DHZ0` | Detect a num_ref_idx_l0_default_active_minus1 outside the range 0-14 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-ref-idx-l1-out-of-range` | `gw-R7J3X9E` | Detect a num_ref_idx_l1_default_active_minus1 outside the range 0-14 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-sps-reference-invalid` | `gw-GD3TVNE` | Detect a pps_seq_parameter_set_id that does not reference a previously parsed SPS | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-tile-column-sum-inconsistent` | `gw-H6Z2WRH` | Detect tile column widths that do not sum to PicWidthInCtbsY | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-tile-columns-out-of-range` | `gw-KXP6CV8` | Detect a num_tile_columns_minus1 outside the range 0-19 when tiles_enabled_flag is 1 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-tile-count-excessive` | `gw-VV6X0TH` | Detect a total tile count (columns times rows) exceeding 440 (Level 6.2 maximum) | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-tile-row-sum-inconsistent` | `gw-YMJ5TA7` | Detect tile row heights that do not sum to PicHeightInCtbsY | `reject` | `report` `omit` | spec; cve; gw | functional |
| `pps-tile-rows-out-of-range` | `gw-W1YPFV4` | Detect a num_tile_rows_minus1 outside the range 0-21 when tiles_enabled_flag is 1 | `reject` | `report` `omit` | spec; cve; gw | functional |

### `sei-messages`

SEI messages carry data no standard decoder needs to render video. user_data payloads are the primary H.265 data-hiding and exfiltration channel; pic_timing and recovery_point disclose decoding state; non-essential payloads carry hidden data; malformed type/size continuation encoding causes integer overflows and buffer over-reads.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `sei-hdr-metadata-present` | `gw-HJ75FAB` | Detect a mastering_display_colour_volume (payloadType 137) or content_light_level_info (payloadType 144) HDR metadata SEI message | `report` | `report` `omit` | gw | visual |
| `sei-non-essential-present` | `gw-HVHWE8S` | Detect a non-essential SEI message outside the retained (HDR metadata) set | `remove` | `remove` `report` `omit` | gw | structural |
| `sei-payload-absent` | `gw-BAZJZ0N` | Detect a SEI NAL unit containing no valid SEI payload | `report` | `report` `omit` | spec; cve; gw | structural |
| `sei-recovery-point-present` | `gw-1N8H3ZC` | Detect a recovery_point (payloadType 6) SEI message | `remove` | `remove` `report` `omit` | gw | structural |
| `sei-size-out-of-bounds` | `gw-N6X4G9H` | Detect a SEI payloadSize exceeding the remaining NAL unit bytes | `report` | `report` `omit` | spec; cve; gw | structural |
| `sei-timing-present` | `gw-BAYF6DY` | Detect a pic_timing (payloadType 1) SEI message | `remove` | `remove` `report` `omit` | gw | structural |
| `sei-type-encoding-invalid` | `gw-0ZC9YDV` | Detect a SEI payloadType using an invalid 0xFF continuation encoding | `report` | `report` `omit` | spec; cve; gw | structural |
| `sei-user-data-present` | `gw-2XK8DY5` | Detect a user_data_registered_itu_t_t35 (payloadType 4) or user_data_unregistered (payloadType 5) SEI message | `remove` | `remove` `report` `omit` | cve; gw | structural |

### `slice-segments`

Slice segment headers reference PPS and reference-picture sets; invalid references cause decoder crashes and memory corruption.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `idr-slice-type-invalid` | `gw-E7855VD` | Detect an IDR picture (NAL types 19-20) with slice_type not equal to 2 (I-slice) | `report` | `report` `omit` | spec; gw | functional |
| `slice-first-flag-invalid` | `gw-D93WJR3` | Detect a first_slice_segment_in_pic_flag not set to 1 for the first slice in a picture | `report` | `report` `omit` | spec; gw | functional |
| `slice-nal-type-inconsistent` | `gw-0J6MYHG` | Detect a slice NAL type inconsistent with the referenced PPS and SPS | `report` | `report` `omit` | spec; cve; gw | functional |
| `slice-pps-reference-invalid` | `gw-MBG96YY` | Detect a slice_pic_parameter_set_id that does not reference a valid PPS | `report` | `report` `omit` | spec; cve; gw | functional |
| `slice-type-out-of-range` | `gw-5P7CKSP` | Detect a slice_type not equal to 0 (B), 1 (P) or 2 (I) | `report` | `report` `omit` | spec; gw | functional |

### `sps`

SPS is the primary attack surface for H.265 decoder exploits (19+ CVEs in libde265). Invalid IDs cause cross-reference failures; crafted picture dimensions are the root cause of heap buffer overflows; excessive reference-picture and coding-tool values cause memory exhaustion, use-after-free and buffer over-reads.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `general-level-idc-invalid` | `gw-6SW7NKN` | Detect a general_level_idc that Annex A does not define or that is too small for the coded picture | `replace` | `replace` `report` `omit` | spec; gw | structural |
| `sps-absent` | `gw-B2YJ2CP` | Detect a stream with no SPS NAL unit (type 33) present | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-bit-depth-chroma-out-of-range` | `gw-D8BNJV3` | Detect a bit_depth_chroma_minus8 outside the range 0-8 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-bit-depth-luma-out-of-range` | `gw-2SN0EHY` | Detect a bit_depth_luma_minus8 outside the range 0-8 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-cb-size-diff-out-of-range` | `gw-4F4SVK0` | Detect a log2_diff_max_min_luma_coding_block_size outside the range 0-3 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-chroma-format-invalid` | `gw-FN6229T` | Detect a chroma_format_idc outside the range 0-3 | `reject` | `report` `omit` | spec; gw | functional |
| `sps-conformance-window-out-of-bounds` | `gw-4F5YXEG` | Detect conformance-window crop offsets exceeding the picture dimensions when conformance_window_flag is 1 | `replace` | `replace` `report` `omit` | spec; gw | functional |
| `sps-dimensions-excessive` | `gw-FC45FXN` | Detect picture dimensions exceeding 16384 in either axis | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-dpb-size-out-of-range` | `gw-K41DYAF` | Detect an sps_max_dec_pic_buffering_minus1 outside the range 0-15 per sub-layer | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-id-out-of-range` | `gw-D7R1MDS` | Detect an sps_seq_parameter_set_id outside the range 0-15 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-latency-out-of-range` | `gw-HHKRD8D` | Detect an sps_max_latency_increase_plus1 outside its valid range | `reject` | `report` `omit` | spec; gw | functional |
| `sps-long-term-rps-count-out-of-range` | `gw-WP8AM00` | Detect a num_long_term_ref_pics_sps outside the range 0-32 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-min-cb-size-out-of-range` | `gw-AB721DC` | Detect a log2_min_luma_coding_block_size_minus3 outside the range 0-3 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-min-tb-size-out-of-range` | `gw-N4QK50H` | Detect a log2_min_luma_transform_block_size_minus2 outside the range 0-3 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-pic-height-out-of-range` | `gw-GNV87T6` | Detect a pic_height_in_luma_samples outside the range 1-16384 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-pic-width-out-of-range` | `gw-1ADR3FV` | Detect a pic_width_in_luma_samples outside the range 1-16384 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-pixel-count-excessive` | `gw-CJJMYS6` | Detect a pic_width times pic_height product exceeding 268435456 luma samples | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-poc-range-out-of-range` | `gw-G5KQTS9` | Detect a log2_max_pic_order_cnt_lsb_minus4 outside the range 0-12 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-reorder-pics-inconsistent` | `gw-5Y1V1D5` | Detect an sps_max_num_reorder_pics greater than sps_max_dec_pic_buffering_minus1 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-short-term-rps-count-out-of-range` | `gw-2EV5742` | Detect a num_short_term_ref_pic_sets outside the range 0-64 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-sub-layer-count-out-of-range` | `gw-0E0FD82` | Detect an sps_max_sub_layers_minus1 outside the range 0-6 | `reject` | `report` `omit` | spec; gw | functional |
| `sps-tb-size-diff-out-of-range` | `gw-V39BM3C` | Detect a log2_diff_max_min_luma_transform_block_size outside the range 0-3 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-tx-depth-inter-out-of-range` | `gw-XMDTTTJ` | Detect a max_transform_hierarchy_depth_inter outside the range 0-4 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-tx-depth-intra-out-of-range` | `gw-RCQC2C6` | Detect a max_transform_hierarchy_depth_intra outside the range 0-4 | `reject` | `report` `omit` | spec; cve; gw | functional |
| `sps-vps-reference-invalid` | `gw-1E184B2` | Detect an sps_video_parameter_set_id that does not reference a previously parsed VPS | `reject` | `report` `omit` | spec; cve; gw | functional |

### `stream-format`

Missing or malformed start codes prevent NAL unit boundary detection and may indicate a crafted stream designed to exploit parser desynchronization between Genesis and the decoder.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `leading-gap-content-present` | `gw-G997AWW` | Detect non-zero data before the first start code prefix | `remove` | `remove` `report` `omit` | spec; gw | structural |
| `nal-unit-size-below-minimum` | `gw-1FEKERM` | Detect a NAL unit shorter than the 2-byte minimum H.265 NAL header size | `report` | `report` `omit` | spec; gw | structural |
| `start-code-absent-unparseable` | `gw-KZPPJR0` | Detect a stream in which no valid start code can be found | `reject` | `report` `omit` | spec; gw | structural |
| `start-code-integrity-invalid` | `gw-RX4X10Q` | Detect a NAL unit not preceded by a valid start code prefix | `report` | `report` `omit` | spec; gw | structural |
| `start-code-prefix-missing` | `gw-GDP6QW1` | Detect a stream that does not begin with a start code prefix (0x000001 or 0x00000001) | `report` | `report` `omit` | spec; gw | structural |

### `structural-integrity`

Resource exhaustion from excessive NAL counts, oversized streams or parameter-set bombing; emulation-prevention byte errors cause parser desynchronization; reserved bits flagged by ITU-T H.265 carry no decoder semantics and a non-zero value is a steganographic signal.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `emulation-prevention-invalid` | `gw-14RKGY7` | Detect an invalid emulation-prevention byte (0x03 after 0x0000) within a NAL payload | `report` | `report` `omit` | spec; gw | structural |
| `nal-count-excessive` | `gw-9D25GPR` | Detect a NAL unit count exceeding the configured maximum (default 100000) | `report` | `report` `omit` | spec; gw | structural |
| `parameter-set-id-conflict` | `gw-376BAJT` | Detect two parameter sets that share an id while coding different pictures | `remove` | `remove` `report` `omit` | spec; gw | structural |
| `pps-count-excessive` | `gw-8QKGFN6` | Detect a PPS count exceeding 64 | `report` | `report` `omit` | spec; gw | structural |
| `reserved-fields-nonzero` | `gw-VSPRES0` | Detect non-zero reserved padding bits in the RBSP trailing byte of a VPS/SPS/PPS parameter set | `replace` | `replace` `report` `omit` | spec; gw | structural |
| `sps-count-excessive` | `gw-ZQ4H44C` | Detect an SPS count exceeding 16 | `report` | `report` `omit` | spec; gw | structural |
| `stream-size-excessive` | `gw-P9BPD5J` | Detect a total stream size exceeding the configured maximum (default 1 GB) | `report` | `report` `omit` | spec; gw | structural |
| `vcl-nal-absent` | `gw-43DC8AC` | Detect a stream with no VCL NAL unit (types 0-9, 16-21) present | `report` | `report` `omit` | spec; gw | structural |
| `vps-count-excessive` | `gw-BGDEJXH` | Detect a VPS count exceeding 16 | `report` | `report` `omit` | spec; gw | structural |

### `trailing-data`

Data after the last NAL unit or after an end_of_bitstream NAL is not part of the H.265 stream and may contain hidden content, appended payloads or polyglot data.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `content-after-end-of-stream` | `gw-2E8XTVW` | Detect NAL units that follow the end-of-sequence or end-of-bitstream NAL unit | `remove` | `remove` `report` `omit` | spec; gw | structural |
| `trailing-data-after-eob-invalid` | `gw-TSCHX54` | Detect data present after the end_of_bitstream NAL unit (type 37) | `report` | `report` `omit` | spec; gw | structural |
| `trailing-data-present` | `gw-67P1QK6` | Detect data present after the last NAL unit in the stream | `remove` | `remove` `report` `omit` | gw | structural |

### `vps`

The VPS defines the overall video coding configuration. Missing VPS prevents correct stream initialization; crafted layer/sub-layer counts cause allocation overflows; crafted timing values cause integer overflows in frame-rate calculations (CVE-2024-31585 FFmpeg HRD overflow).

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `vps-absent` | `gw-FRSPS4Y` | Detect a stream with no VPS NAL unit (type 32) present | `reject` | `report` `omit` | spec; gw | functional |
| `vps-id-out-of-range` | `gw-8T34QPK` | Detect a vps_video_parameter_set_id outside the range 0-15 | `reject` | `report` `omit` | spec; gw | functional |
| `vps-layer-count-invalid` | `gw-8VWT9E1` | Detect a vps_max_layers_minus1 not equal to 0 in a single-layer stream | `reject` | `report` `omit` | spec; gw | functional |
| `vps-sub-layer-count-out-of-range` | `gw-0FYZEJA` | Detect a vps_max_sub_layers_minus1 outside the range 0-6 | `reject` | `report` `omit` | spec; gw | functional |
| `vps-temporal-nesting-invalid` | `gw-GV6HZFE` | Detect a vps_temporal_id_nesting_flag not set to 1 when vps_max_sub_layers_minus1 is 0 | `reject` | `report` `omit` | spec; gw | functional |
| `vps-time-scale-invalid` | `gw-27M6911` | Detect a vps_time_scale of 0 when timing information is present | `replace` | `replace` `report` `omit` | spec; cve; gw | functional |
| `vps-timing-units-invalid` | `gw-D8EG91B` | Detect a vps_num_units_in_tick of 0 when timing information is present | `replace` | `replace` `report` `omit` | spec; cve; gw | functional |

## SIDD (`sidd`)

### `annotations`

Excessive annotation counts cause rendering DoS. Oversized annotation text fields can carry covert channel data. Invalid geometry coordinates can cause renderer crashes.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `annotation-count-excessive` | `gw-0VWADCH` | Detect more than 1000 annotations (rendering denial-of-service vector) | `reject` | `report` `omit` | spec; gw | functional |
| `annotation-count-invalid` | `gw-1Q2AB6Q` | Detect a total annotation count exceeding 1000 | `report` | `report` `omit` | spec; gw | functional |
| `annotation-identifier-invalid` | `gw-Q629WZD` | Detect an Annotation/Identifier that is empty or longer than 256 characters | `report` | `report` `omit` | spec; gw | functional |
| `line-vertices-invalid` | `gw-DSY4R9T` | Detect line geometry with fewer than 2 vertices or invalid coordinates | `report` | `report` `omit` | spec; gw | functional |
| `point-vertices-invalid` | `gw-057GREV` | Detect point geometry with non-finite coordinates | `report` | `report` `omit` | spec; gw | functional |
| `polygon-vertices-invalid` | `gw-BS035SQ` | Detect polygon geometry with fewer than 3 vertices or invalid coordinates | `report` | `report` `omit` | spec; gw | functional |
| `text-length-invalid` | `gw-0Z5DT6W` | Detect annotation text content exceeding 4096 characters | `report` | `report` `omit` | spec; gw | functional |

### `classification`

Classification marking tampering is the highest-risk threat for SIDD files. Mismatched markings between SIDD XML and NITF headers cause security spillage, an unregistered codeword or releasability value grants handling no register defines and markings that contradict each other let a reader who honors one of them under-protect the product.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `classification-marking-confusable` | `gw-RTWES0X` | Detect a SIDD classification that matches the NITF security fields only after unicode folding | `reject` | `report` `omit` | gw; analogy | functional |
| `declassification-marking-incoherent` | `gw-QGZQ12Z` | Detect declassification instructions that contradict the classification or each other | `reject` | `report` `omit` | spec; gw | functional |
| `declassification-marking-invalid` | `gw-00N9G0B` | Detect a declassification instruction outside the IC-ISM exemption register | `report` | `report` `omit` | spec; gw | functional |
| `dissemination-marking-invalid` | `gw-NKN89NC` | Detect a dissemination control marking outside the IC-ISM register | `report` | `report` `omit` | spec; gw | functional |
| `marking-exceeds-level` | `gw-9QKJ44W` | Detect a compartment or restricted-data marking on unclassified content | `reject` | `report` `omit` | spec; gw | functional |
| `marking-token-limit-exceeded` | `gw-MMEWKVW` | Detect a marking list carrying more tokens than the IC-ISM schema permits | `report` | `report` `omit` | spec; gw | functional |
| `releasability-marking-incoherent` | `gw-43873GB` | Detect releasability and dissemination markings that contradict each other | `reject` | `report` `omit` | spec; gw | functional |
| `releasability-marking-invalid` | `gw-XN0ASSH` | Detect a releasability marking outside the IC-ISM country register | `report` | `report` `omit` | spec; gw | functional |
| `required-marking-absent` | `gw-6TR4PZZ` | Detect a required IC-ISM marking absent from the Classification element | `reject` | `report` `omit` | spec; gw | functional |
| `security-classification-invalid` | `gw-CJHN188` | Detect a classification level outside the IC-ISM portion-mark register | `report` | `report` `omit` | spec; gw | functional |
| `security-control-system-invalid` | `gw-1ST95XK` | Detect a control-system marking outside the IC-ISM codeword register | `report` | `report` `omit` | spec; gw | functional |
| `security-policy-identifier-invalid` | `gw-FS95YTK` | Detect a compliance declaration outside the IC-ISM register | `report` | `report` `omit` | spec; gw | functional |

### `des-identification`

Non-standard DESID values could bypass SIDD detection. DES count mismatches indicate structural tampering. Version mismatches may cause parser confusion. A DES that shares the XML_DATA_CONTENT identifier but carries a non-SIDD dialect (e.g. SICD) is content the SIDD camera cannot inspect and must not pass through unremediated.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `data-length-invalid` | `gw-SDRRAYB` | Detect a DES data length inconsistent with the actual XML content size | `report` | `report` `omit` | spec; gw | functional |
| `des-count-invalid` | `gw-REK69W3` | Detect a NUMDES in the NITF header inconsistent with the actual DES segment count | `report` | `report` `omit` | spec; gw | functional |
| `des-identifier-invalid` | `gw-HM4A51T` | Detect a DES identifier (DESID) that is not 'XML_DATA_CONTENT' for a SIDD DES | `report` | `report` `omit` | spec; gw | functional |
| `des-version-invalid` | `gw-T0MY6CJ` | Detect a DES version (DESVER) that is not a valid SIDD version | `report` | `report` `omit` | spec; gw | functional |
| `sidd-des-missing` | `gw-Q7CMXF2` | Detect no DES segment carrying SIDD XML metadata | `reject` | `report` `omit` | spec; gw | functional |
| `unsupported-schema-version` | `gw-T57H90C` | Detect a recognized SIDD-family namespace (SIDD / SICommon / SFA / IC-ISM) declared at a schema version Genesis does not support | `reject` | `report` `omit` | gw | functional |
| `unsupported-xml-des` | `gw-SDCXDES` | Detect an XML_DATA_CONTENT DES whose XML root is not a SIDD namespace (unsupported variant, e.g. SICD) | `reject` | `report` `omit` | isg; gw | functional |

### `display`

Invalid pixel type or band count values can cause buffer miscalculation in image renderers. Inconsistent band indices cause out-of-bounds access.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `band-count-invalid` | `gw-91YSXCQ` | Detect a NumBands inconsistent with PixelType (1 for mono types, 3 for RGB types) | `report` | `report` `omit` | spec; gw | functional |
| `band-indices-invalid` | `gw-ZJQ2CX3` | Detect a DefaultBandDisplay index outside the range 1 to NumBands | `report` | `report` `omit` | spec; gw | functional |
| `downsampling-method-invalid` | `gw-HQPDMRJ` | Detect a DownsamplingMethod that is not a valid enumeration value | `report` | `report` `omit` | spec; gw | functional |
| `pixel-type-invalid` | `gw-1QD19NY` | Detect a PixelType other than MONO8I, MONO8LU, MONO16I, RGB8LU or RGB24I | `report` | `report` `omit` | spec; gw | functional |

### `downstream-reprocessing`

Zero or negative chip dimensions can cause buffer allocation errors in downstream processors.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `chip-size-column-invalid` | `gw-VVQPFH5` | Detect a GeometricChip/ChipSize/Col that is not a positive integer | `report` | `report` `omit` | spec; gw | functional |
| `chip-size-row-invalid` | `gw-X7MMGSH` | Detect a GeometricChip/ChipSize/Row that is not a positive integer | `report` | `report` `omit` | spec; gw | functional |

### `exploitation-features`

Invalid collection geometry angles can mislead SAR image interpretation. Non-finite resolution values cause rendering errors.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `azimuth-invalid` | `gw-MN58M6K` | Detect a Geometry/Azimuth outside the range 0.0 to 360.0 degrees | `report` | `report` `omit` | spec; gw | functional |
| `collection-datetime-invalid` | `gw-GQ1469Z` | Detect a Collection/DateTime that is not a valid ISO 8601 datetime | `report` | `report` `omit` | spec; gw | functional |
| `collection-duration-invalid` | `gw-G190WXV` | Detect a CollectionDuration that is not positive and finite | `report` | `report` `omit` | spec; gw | functional |
| `collection-identifier-invalid` | `gw-JSMB9H3` | Detect a Collection/Identifier that is empty or longer than 256 characters | `report` | `report` `omit` | spec; gw | functional |
| `doppler-cone-angle-invalid` | `gw-RXBE629` | Detect a Geometry/DopplerConeAngle outside the range 0 to under 180 degrees | `report` | `report` `omit` | spec; gw | functional |
| `ellipticity-invalid` | `gw-WP9N4WZ` | Detect a Product/Ellipticity that is not positive and finite | `report` | `report` `omit` | spec; gw | functional |
| `graze-invalid` | `gw-SP3K0TP` | Detect a Geometry/Graze outside the range 0.0 to 90.0 degrees | `report` | `report` `omit` | spec; gw | functional |
| `ground-track-angle-invalid` | `gw-0EJ93RZ` | Detect a Phenomenology/GroundTrack angle outside the range -180 to 180 degrees | `report` | `report` `omit` | spec; gw | functional |
| `layover-magnitude-invalid` | `gw-MB1H8VX` | Detect a Phenomenology/Layover magnitude that is not positive and finite | `report` | `report` `omit` | spec; gw | functional |
| `multipath-angle-invalid` | `gw-YAV8V4C` | Detect a Phenomenology/MultiPath angle outside the range -180 to 180 degrees | `report` | `report` `omit` | spec; gw | functional |
| `north-angle-invalid` | `gw-BMVB1DH` | Detect a Product/North angle outside the range -180 to 180 degrees | `report` | `report` `omit` | spec; gw | functional |
| `polarization-invalid` | `gw-TAPVM25` | Detect a processed polarization outside the SICommon enumeration | `report` | `report` `omit` | spec; gw | functional |
| `resolution-column-invalid` | `gw-5M4Z8ZM` | Detect a Product/Resolution/Col that is not a positive finite value | `report` | `report` `omit` | spec; gw | functional |
| `resolution-row-invalid` | `gw-S2BV02E` | Detect a Product/Resolution/Row that is not a positive finite value | `report` | `report` `omit` | spec; gw | functional |
| `sensor-name-invalid` | `gw-XCG08KD` | Detect a Collection/Information/SensorName that is empty or over-long | `report` | `report` `omit` | spec; gw | functional |
| `shadow-magnitude-invalid` | `gw-QGXJR6T` | Detect a Phenomenology/Shadow magnitude that is not positive and finite | `report` | `report` `omit` | spec; gw | functional |
| `slope-invalid` | `gw-RS97C0G` | Detect a Geometry/Slope outside the range 0.0 to 90.0 degrees | `report` | `report` `omit` | spec; gw | functional |
| `squint-invalid` | `gw-1XA7EF7` | Detect a Geometry/Squint outside the range -180.0 to 180.0 degrees | `report` | `report` `omit` | spec; gw | functional |
| `tilt-invalid` | `gw-VT69Z5X` | Detect a Geometry/Tilt outside the range -90.0 to 90.0 degrees | `report` | `report` `omit` | spec; gw | functional |

### `geodata`

Geographic coordinate spoofing places imagery at incorrect locations, potentially misleading intelligence analysts. Invalid earth model references cause projection errors.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `corner-count-invalid` | `gw-N1HN5A4` | Detect image corner points other than exactly four with correct index values | `report` | `report` `omit` | spec; gw | functional |
| `corner-latitudes-invalid` | `gw-CCW5KA6` | Detect an image corner point latitude outside the range -90.0 to 90.0 | `report` | `report` `omit` | spec; gw | functional |
| `corner-longitudes-invalid` | `gw-D78DPFV` | Detect an image corner point longitude outside the range -180.0 to 180.0 | `report` | `report` `omit` | spec; gw | functional |
| `data-bounds-invalid` | `gw-KQ6KFJ6` | Detect a ValidData vertex outside the geographic range or the image bounds | `report` | `report` `omit` | spec; gw | functional |
| `data-vertices-invalid` | `gw-NXH4FJS` | Detect ValidData with fewer than 3 vertices | `report` | `report` `omit` | spec; gw | functional |
| `earth-model-invalid` | `gw-MG49660` | Detect an EarthModel other than 'WGS_84' | `report` | `report` `omit` | spec; gw | functional |

### `measurement`

Zero or negative pixel footprint dimensions cause division-by-zero in renderers. NaN or Infinity polynomial coefficients cause floating-point exceptions. Dimension mismatches between SIDD XML and NITF headers indicate structural tampering.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `arp-polynomial-invalid` | `gw-RJ56GVH` | Detect ARPPoly X/Y/Z coefficients that are not finite (NaN or Infinity) | `report` | `report` `omit` | spec; gw | functional |
| `footprint-column-invalid` | `gw-C902ACT` | Detect a PixelFootprint/Col outside the range 1 to 100000 | `report` | `report` `omit` | spec; gw | functional |
| `footprint-nitf-inconsistent` | `gw-VKEP08W` | Detect a PixelFootprint inconsistent with the NITF image dimensions | `report` | `report` `omit` | spec; gw | functional |
| `footprint-row-invalid` | `gw-ZPP3VTA` | Detect a PixelFootprint/Row outside the range 1 to 100000 | `report` | `report` `omit` | spec; gw | functional |
| `projection-type-invalid` | `gw-A7X6B6H` | Detect a projection element that is not one of the four schema choices | `report` | `report` `omit` | spec; gw | functional |
| `time-coa-polynomial-invalid` | `gw-Q2CYXWN` | Detect TimeCOAPoly coefficients that are not finite (NaN or Infinity) | `report` | `report` `omit` | spec; gw | functional |

### `metadata-content-safety`

Schema-legitimate free-text metadata fields cannot be blanked without breaking a valid SIDD product, so a smuggled string (an external URI, a printf format specifier, a prototype-pollution key name or a Unicode bidi/zero-width control) survives CDR byte-for-byte. Genesis never dereferences or interprets these values, so there is no in-process exploit; the residual is covert-channel carriage and downstream-consumer risk. Detecting them keeps a carrier file from being reported fully clean, and the opt-in removals excise the smuggled substring while preserving the surrounding field text.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `bidi-control-present` | `gw-JAVH938` | Detect Unicode bidirectional or zero-width format controls in free-text product metadata | `report` | `report` `remove` `omit` | gw; analogy | functional |
| `external-uri-present` | `gw-ZD2XT8E` | Detect an external URI or network reference (http/https/ftp/file scheme or UNC path) in free-text product metadata | `report` | `report` `remove` `omit` | gw | functional |
| `format-specifier-present` | `gw-3KATT09` | Detect potential printf-style format specifiers (for example %n or %s) in free-text product metadata | `report` | `report` `remove` `omit` | gw | functional |
| `prototype-pollution-token-present` | `gw-YKTE7V9` | Detect potential JavaScript prototype-pollution key names (for example __proto__ or constructor.prototype) in free-text product metadata | `report` | `report` `omit` | gw | functional |

### `nitf-cross-validation`

Mismatches between SIDD XML metadata and NITF header fields indicate structural tampering, potential security marking spillage or deliberate parser confusion attacks. A marking divergence is spillage in either direction: a reader that honors the container ignores what the XML declares, and a reader that honors the XML ignores what the container declares.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `compartment-marking-undeclared` | `gw-GBF3505` | Detect a NITF codeword field asserting a compartment the SIDD XML does not declare | `report` | `report` `omit` | gw | functional |
| `declassification-marking-undeclared` | `gw-1J738J1` | Detect a NITF declassification date the SIDD XML does not declare in any form | `report` | `report` `omit` | gw | functional |
| `declassification-nitf-mismatch` | `gw-3MY6B2A` | Detect SIDD declassification instructions that disagree with the NITF declassification fields | `reject` | `report` `omit` | spec; gw | functional |
| `des-count-inconsistent` | `gw-TMKRTBS` | Detect a NUMDES in the NITF file header inconsistent with the actual DES segment count | `report` | `report` `omit` | spec; gw | functional |
| `dimension-column-inconsistent` | `gw-PRS36KR` | Detect a PixelFootprint/Col inconsistent with the NITF image segment NCOLS | `report` | `report` `omit` | spec; gw | functional |
| `dimension-row-inconsistent` | `gw-7AH5PH7` | Detect a PixelFootprint/Row inconsistent with the NITF image segment NROWS | `report` | `report` `omit` | spec; gw | functional |
| `dissemination-nitf-mismatch` | `gw-PXE61YD` | Detect a NITF releasability field that releases content the SIDD XML marks NOFORN | `reject` | `report` `omit` | spec; gw | functional |
| `file-classification-mismatch` | `gw-N9THCGY` | Detect a SIDD classification that does not match the NITF file-level security classification | `reject` | `report` `omit` | spec; gw | functional |
| `image-category-invalid` | `gw-81R2SR5` | Detect a NITF ICAT other than 'SAR' or an appropriate value for SAR-derived imagery | `report` | `report` `omit` | spec; gw | functional |
| `multiple-sidd-des` | `gw-K357JJK` | Detect other than exactly one SIDD XML DES per image product | `report` | `report` `omit` | spec; gw | functional |
| `segment-classification-mismatch` | `gw-Z6R16QY` | Detect a NITF segment subheader classification inconsistent with the SIDD product classification | `reject` | `report` `omit` | spec; gw | functional |

### `product-creation`

Oversized string fields in ProductCreation can be used for data hiding. Invalid processing timestamps could indicate tampering.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `processing-datetime-invalid` | `gw-NTS4689` | Detect a ProcessorInformation/ProcessingDateTime that is not a valid ISO 8601 datetime | `report` | `report` `omit` | spec; gw | functional |
| `processor-application-invalid` | `gw-6XP7AG2` | Detect a ProcessorInformation/Application that is empty or longer than 256 characters | `report` | `report` `omit` | spec; gw | functional |
| `processor-site-invalid` | `gw-V81NDY1` | Detect a ProcessorInformation/Site longer than 256 characters | `report` | `report` `omit` | spec; gw | functional |
| `product-class-invalid` | `gw-89F9CAM` | Detect a ProductClass that is empty or longer than 256 characters | `report` | `report` `omit` | spec; gw | functional |
| `product-name-invalid` | `gw-5Y8411V` | Detect a ProductName that is empty or longer than 1024 characters | `report` | `report` `omit` | spec; gw | functional |
| `product-type-invalid` | `gw-2FX9F0C` | Detect a ProductType longer than 256 characters | `report` | `report` `omit` | spec; gw | functional |

### `product-processing`

Excessive processing module chains can indicate data smuggling. Oversized module names can carry hidden data.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `module-count-invalid` | `gw-FSS7ZY4` | Detect a processing module count exceeding 100 | `report` | `report` `omit` | spec; gw | functional |
| `module-name-invalid` | `gw-3QTTNJA` | Detect a ProcessingModule/ModuleName that is empty or longer than 256 characters | `report` | `report` `omit` | spec; gw | functional |

### `required-elements`

Missing required elements indicate a malformed or truncated SIDD document that could confuse downstream processors or bypass validation.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `display-missing` | `gw-YYXY3FQ` | Detect a Display element that is missing or empty | `report` | `report` `omit` | spec; gw | functional |
| `exploitation-features-missing` | `gw-X7P4QMA` | Detect an ExploitationFeatures element that is missing or empty | `report` | `report` `omit` | spec; gw | functional |
| `geo-data-missing` | `gw-JMB6FZD` | Detect a GeoData element that is missing or empty | `report` | `report` `omit` | spec; gw | functional |
| `measurement-missing` | `gw-49WNGHS` | Detect a Measurement element that is missing or empty | `report` | `report` `omit` | spec; gw | functional |
| `product-creation-missing` | `gw-K82V8TN` | Detect a ProductCreation element that is missing or empty | `report` | `report` `omit` | spec; gw | functional |
| `sidd-root-invalid` | `gw-AR9HBBZ` | Detect a root element other than 'SIDD' with a valid namespace | `report` | `report` `omit` | spec; gw | functional |

### `schema-coverage`

A SIDD that violates the XSD occurrence / choice / enumeration constraints is self-inconsistent: a duplicate of a singleton element, more than one projection choice or an out-of-range enumerated value can drive divergent interpretations across downstream consumers - a parser-differential surface.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `choice-violation` | `gw-Z4853N6` | Detect more than one branch of an xs:choice group present under the same parent | `report` | `report` `omit` | spec; gw | structural |
| `declared-count-mismatch` | `gw-4TQZP8N` | Detect a declared count attribute that disagrees with the elements it describes | `replace` | `replace` `report` `omit` | spec; gw | structural |
| `duplicate-element` | `gw-7SSCTKS` | Detect a SIDD element that appears more times under its parent than the schema permits | `report` | `report` `omit` | spec; gw | structural |
| `enumeration-value-invalid` | `gw-8XGWSFV` | Detect a closed-enumeration SIDD element carrying a value outside its schema value space | `report` | `report` `omit` | spec; gw | structural |
| `non-finite-number-present` | `gw-7QGFGQB` | Detect a NaN or infinite value in a field whose schema type admits it | `report` | `report` `remove` `omit` | gw; analogy | functional |
| `numeric-value-invalid` | `gw-W2DGXB2` | Detect a numeric value outside the value space its schema type declares | `reject` | `report` `omit` | spec; gw; analogy | structural |
| `polynomial-order-mismatch` | `gw-9BVK37X` | Detect polynomial coefficients that contradict the order the polynomial declares | `report` | `report` `omit` | spec; gw | structural |

### `xml-structure`

DOCTYPE declarations enable XXE injection (SSRF, file disclosure, DoS). Processing instructions can load external resources. CDATA sections and comments can smuggle hidden data. Namespace redirection can point to attacker-controlled schemas.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `cdata-sections-present` | `gw-6KC9E6R` | Detect CDATA sections that may carry smuggled content | `replace` | `replace` `report` `omit` | gw | structural |
| `extension-attributes-present` | `gw-FHWD2DE` | Detect non-schema attributes on known SIDD elements | `remove` | `remove` `report` `omit` | gw | structural |
| `extra-namespaces-present` | `gw-G8Z6XZ4` | Detect namespace declarations beyond the SIDD namespace | `remove` | `remove` `report` `omit` | gw | structural |
| `namespace-uri-invalid` | `gw-K1EJW4D` | Detect a root element namespace that is not a supported SIDD version (1.0.0 / 2.0.0 / 3.0.0) | `report` | `report` `omit` | spec; gw | structural |
| `processing-instructions-present` | `gw-E823KNZ` | Detect XML processing instructions other than the XML declaration | `remove` | `remove` `report` `omit` | gw | structural |
| `unknown-elements-present` | `gw-DCSXWT0` | Detect XML elements not defined in the SIDD schema | `remove` | `remove` `report` `omit` | gw | structural |
| `xinclude-present` | `gw-DEV6W3G` | Detect W3C XInclude directives in the SIDD XML—DOCTYPE-independent external file inclusion / SSRF | `remove` | `remove` `report` `omit` | gw | structural |
| `xml-comments-present` | `gw-VEW0J03` | Detect XML comments that may carry covert-channel hidden data | `remove` | `remove` `report` `omit` | gw | structural |
| `xml-doctype-present` | `gw-F4XE4P0` | Detect a DOCTYPE declaration in the SIDD XML (XXE injection vector) | `reject` | `report` `omit` | gw | structural |
| `xml-null-bytes-present` | `gw-KR0ZCMW` | Detect null bytes in SIDD XML string values | `reject` | `report` `omit` | gw | structural |
| `xml-size-invalid` | `gw-CJ0YW13` | Detect a total XML size exceeding 10 MB | `reject` | `report` `omit` | spec; gw | structural |