What Is a Polyglot File? How Can One File Be Valid as Multiple File Formats?

A polyglot file is a sequence of bytes that adheres to the structural requirements of multiple file formats. This means that the same byte sequence can be correctly parsed and interpreted as different file types by separate parsers.

To understand how this works, it's essential to grasp what a file format is. A file format is a specification that defines how bytes should be structured and interpreted. Key elements include the file's beginning (often signified by a recognizable sequence of bytes known as a magic number or file signature), the structure of the header, where the actual content data resides, how size, offset, and length values are encoded, and where the file ends, or where markers indicate the end of meaningful content.

Various file formats begin with specific byte sequences, such as %PDF- for PDFs, FF D8 FF for JPEGs, and PK for ZIP archives. These initial bytes are not merely labels; they are essential structural elements that a conforming parser expects to find.

A polyglot file exploits the differences in how different parsers interpret file structures. While one parser might require specific elements at the beginning of the file, another might focus on structures at particular offsets or ignore data it does not recognize. This discrepancy opens up space for a single byte sequence to satisfy multiple parser expectations simultaneously.

It's crucial to differentiate a polyglot file from a renamed malicious file. Simply changing the extension of a file does not alter the bytes inside; a robust validator that thoroughly parses the entire file using the expected format's grammar would reject such a file. Polyglots are more insidious because they genuinely satisfy the syntax rules of multiple file formats, not just due to superficial similarities in the initial bytes.