shinigami-777/PoC_CVE-2025-11579

GitHubRepository PoCExploit

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go program that uses the vulnerable rardecode library to open a crafted RAR file with an artificially large dictionary size, triggering an out-of-memory crash.

Backdoor review

No backdoor observed in reviewed code

The supplied text evidence (README.md, exploit.go, go.mod, go.sum) describes and implements a proof-of-concept for CVE-2025-11579, a denial-of-service vulnerability in the rardecode library. The Go code opens a provided RAR file and attempts extraction, which is expected to trigger an out-of-memory crash due to an excessively large dictionary size. No backdoor, deceptive payload, or concealed operator-directed harm is observed in the reviewed text files. Two binary RAR archives are present but were not analyzed; their metadata is reported but their contents are uninspected.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesGo
Target softwaregithub.com/nwaples/rardecode
Attack typesDenial of Service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact includes executable Go code (exploit.go) that actively opens a malicious RAR file to trigger the vulnerability, which is the definition of an exploit. The README explicitly states 'We craft a RAR file... causing the library to attempt massive memory allocations and then have an Out of Memory Crash' and instructs the user to run the code.

exploit.go:1-55README.md:6-10

Requirements

  • Requires the vulnerable rardecode library v2.1.1.go.mod:5
  • Requires a specially crafted RAR file (14Gb.rar) with an artificially large dictionary size.README.md:7exploit.go:13

Observed behavior

  • Opens the crafted RAR file and creates a reader, which triggers massive memory allocation and an out-of-memory crash.exploit.go:15-26README.md:7
  • Iterates through archive entries and attempts to extract files, though the crash likely occurs during reader initialization.exploit.go:30-52
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Binary Archive
14Gb.rar (sha256:f74b0493e354b940c0006065c5d1b4666cf9f61e806226b195c04de58c37e5e6)Binary RAR file intended to trigger the DoS vulnerability; contents uninspected.README.md:10
Binary Archive
simple.rar (sha256:b2854d9ead8b3a2e9bae8f87cabe61ea0116c9ed9d099131bf1f3bd358978912)Binary RAR file described as a normal file for successful extraction; contents uninspected.README.md:13
Vulnerability Reference
CVE-2025-11579The PoC targets a known DoS vulnerability in rardecode <=2.1.1.README.md:1
Review boundaries

What the analysis did not establish

  • The malicious RAR file (14Gb.rar) is present as a binary and was not analyzed; its exact structure is unknown.
  • The evidence does not include runtime output confirming the crash, only a screenshot reference in the README.
  • Two binary RAR files (14Gb.rar, simple.rar) are present in the artifact but were not analyzed; their contents could contain unrelated payloads.
  • One text file (likely go.sum or similar) is reported in metadata but its content is not included in the evidence packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1