CVE-2025-65410: 
NixOS vulnerability analysis and mitigation

CVE-2025-65410 is a stack-based buffer overflow (CWE-121) in the src/main.c component of GNU Unrtf v0.21.10 that allows local attackers to cause a Denial of Service (DoS) by supplying a crafted filename argument. The vulnerability was reported on November 4, 2025, and publicly disclosed on December 23, 2025. Only GNU Unrtf version 0.21.10 is confirmed affected. It carries a CVSS v3.1 base score of 6.2 (Medium), assessed by CISA-ADP (Red Hat Bugzilla, GitHub PoC).

The root cause is unbounded string operations on a fixed-size stack buffer in main() within src/main.c. Specifically, the code declares char path2[200] and then uses strcpy(path2, path) followed by strcat(path2, ".rtf") on a user-controlled filename, with no length validation. If the supplied filename is approximately 196 characters or longer, the unconditional .rtf append overflows path2, corrupting adjacent stack memory including the saved return address. On hardened builds with stack canaries, this triggers *** stack smashing detected *** and a SIGABRT; on builds without such mitigations, return address hijacking and arbitrary code execution may be feasible. The upstream fix replaces the unsafe operations with snprintf(path2, sizeof(path2), "%s.rtf", path) (GitHub PoC, GNU Mailing List).

Successful exploitation on hardened builds reliably crashes the unrtf process via SIGABRT (core dump), resulting in a high availability impact for any service or pipeline that depends on Unrtf for RTF document conversion. On non-hardened builds lacking stack canaries or ASLR, the overflow could theoretically enable local code execution by overwriting the return address, potentially compromising confidentiality and integrity as well. There is no direct network exposure, as the attack vector is local and requires the ability to supply a crafted filename to the application (GitHub PoC).

A public proof-of-concept exploit is available on GitHub, demonstrating reliable crash reproduction using a filename of approximately 240 characters. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.000150 (very low probability of exploitation in the near term). No threat actor attribution has been reported (GitHub PoC, Red Hat Bugzilla).

1. Identify target: Locate a system running GNU Unrtf v0.21.10, particularly in automated document-processing pipelines where user-controlled filenames are passed to unrtf.
2. Craft overlong filename: Create a filename with approximately 240 or more characters (e.g., 240 × 'A') to ensure that when .rtf is appended internally, the total length exceeds the 200-byte path2 buffer.
3. Prepare RTF content: Create a file with that overlong name containing minimal valid RTF content (e.g., {\rtf1\ansi\deff0{\fonttbl{\f0 Arial;}} \pard Hello\par }) so execution reaches the vulnerable filename-handling code path in main().
4. Invoke unrtf: Execute ./unrtf <overlong_filename> (without the .rtf extension, as the code appends it internally).
5. Observe crash: On hardened builds, the output will include *** stack smashing detected ***: terminated followed by Aborted (core dump), confirming the stack overflow. On non-hardened builds, the return address may be overwritten, enabling potential code execution (GitHub PoC).

• Process: unrtf process terminating abnormally with SIGABRT; presence of core dump files (e.g., core, core.<pid>) in the working directory or configured core dump location.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing entries like unrtf: *** stack smashing detected ***: terminated or Aborted (core dumped) associated with the unrtf process.
• File System: Unexpected core dump files in directories where unrtf is executed; unusually long filenames (≥196 characters) with .rtf extension in input directories processed by unrtf.
• Application Logs: Document conversion pipeline logs showing repeated failures or crashes of unrtf invocations with long filename arguments (GitHub PoC).

The upstream fix is available in the GNU Unrtf Mercurial repository as revision a5d3b025a8b1, which replaces the unsafe strcpy/strcat pattern with a bounded snprintf call. Users should upgrade to any Unrtf release that includes this changeset. For environments unable to upgrade immediately: restrict local access to systems running the vulnerable version, prevent untrusted users from supplying arbitrary filenames to unrtf, and ensure compiler-level mitigations (stack canaries, ASLR, NX) are enabled to limit exploitability. Red Hat has tracked this issue in Bugzilla (bug ID 2424619) and downstream distribution patches may be available (GNU Upstream Fix, Red Hat Bugzilla).

The vulnerability was reported responsibly by researcher "wheat MAX" to the GNU Unrtf maintainer Jean-Francois Dockes via private Savannah bug entries (#67666, #67667) and the bug-unrtf mailing list in November 2025. The maintainer acknowledged the report promptly and confirmed the fix within one day. Red Hat's Product Security team tracked the issue via OSIDB and opened a Bugzilla entry on the day of public disclosure. No significant broader media coverage or notable social media discussion has been observed beyond standard vulnerability database aggregation (GNU Mailing List, Red Hat Bugzilla).