Lets assume I'm talking about Jpeg and Mp4 and a general video player(not sure if different ones load it differently, if they do please tell)

So do video players (process) usually load the entire Jpeg or Mp4 including metadata into its own memory space right? like lets say we have a 1920x1080 picture with 10 bytes of metadata, does the picture viewer's process loads this into its own heap or maybe stack? and does it read it sequentially in order to display it?

I'm asking this because i want to know what stops criminals to for example inject some part of a video or picture with malware, lets say 10 malicious instructions are hidden in that file in a frame of a video or part of a picture, what stops the operating system with no good anti virus from executing these malicious instructions?

  • $\begingroup$ There are exploits based on pictures and videos. $\endgroup$ Commented Sep 28, 2018 at 6:59
  • $\begingroup$ @YuvalFilmus i just want to know how they are usually loaded in the process's memory space and what will happen if i inject some part of a video/picture with malicious instructions? will the instructions be executed or what stops it from happening? $\endgroup$
    – John P
    Commented Sep 28, 2018 at 7:00
  • $\begingroup$ This probably depends on the piece of software, but large files are probably loaded in chunks rather than all at once. $\endgroup$ Commented Sep 28, 2018 at 7:01
  • 1
    $\begingroup$ See this: security.stackexchange.com/questions/97856/…. It seems your question is more suitable to that stackexchange. $\endgroup$ Commented Sep 28, 2018 at 7:05
  • 1
    $\begingroup$ What a particular piece of software does is entirely up to the author of that software. While there are probably patterns that are common to most pieces of software that perform some function, that's just because it's the most natural thing to do. You can't assume that every video player behaves in the same way. $\endgroup$ Commented Sep 28, 2018 at 11:18

1 Answer 1


Just having malicious instructions loaded into memory is not a problem in itself. Instructions (code) is just binary, so it might be stored in the data segment.

Where it becomes a problem is if something causes that code to be executed. It's not clear why a video player would jump to data inside an image. If it had a security vulnerability, that could happen, but if it has a vulnerability, almost by definition bad things could happen, so that's not really saying much.


Not the answer you're looking for? Browse other questions tagged or ask your own question.