CVE-2025-65411
📋 TL;DR
A NULL pointer dereference vulnerability in GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) by injecting a crafted payload into the search_path parameter. This affects systems running the vulnerable version of GNU Unrtf, potentially crashing the application when processing malicious input.
💻 Affected Systems
- GNU Unrtf
📦 What is this software?
Unrtf by Unrtf Project
UnRTF is a command-line utility that converts Rich Text Format (RTF) documents to other formats including HTML, LaTeX, and plain text. It is commonly used in document processing pipelines and text extraction workflows where RTF files need to be converted to more accessible formats.
Learn more about Unrtf →⚠️ Risk & Real-World Impact
Worst Case
Complete application crash leading to denial of service, potentially disrupting document conversion workflows that rely on unrtf.
Likely Case
Application crash when processing maliciously crafted input, requiring restart of the unrtf process.
If Mitigated
No impact if input validation or proper error handling is implemented.
🎯 Exploit Status
The vulnerability is in a specific parameter and requires crafting a payload to trigger the NULL pointer dereference.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check upstream for patched version as this is a recent CVE
Vendor Advisory: https://lists.gnu.org/archive/html/bug-unrtf/2025-11/msg00000.html
Restart Required: No
Instructions:
1. Monitor GNU Unrtf project for security updates. 2. Apply the official patch when available. 3. Recompile from source if using source distribution.
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize all input passed to the search_path parameter
Process Isolation
allRun unrtf in a sandboxed or containerized environment to limit impact
🧯 If You Can't Patch
- Restrict unrtf usage to trusted inputs only
- Monitor for crash events and implement automatic restart mechanisms
🔍 How to Verify
Check if Vulnerable:
Check unrtf version with 'unrtf --version' and verify if it's 0.21.10Check Version:
unrtf --versionVerify Fix Applied:
After patching, test with known malicious payloads to ensure the application doesn't crash📡 Detection & Monitoring
Log Indicators:
- Application crash logs
- Segmentation fault errors in system logs
SIEM Query:
source="system_logs" AND ("segmentation fault" OR "unrtf" AND "crash")🔗 References
- https://github.com/MAXEUR5/Vulnerability_Disclosures/blob/main/2025/CVE-2025-65411.md
- https://lists.gnu.org/archive/html/bug-unrtf/2025-11/msg00000.html
- https://savannah.gnu.org/projects/unrtf/
- https://sources.debian.org/src/unrtf/0.21.10-clean-1/src/main.c/#L661
- https://www.gnu.org/software/unrtf/
- https://github.com/MAXEUR5/Vulnerability_Disclosures/blob/main/2025/CVE-2025-65411.md
