R3n3r0/cve-2025-5915

GitHubRepository PoCExploit

PoC files

55 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a comprehensive exploit for CVE-2025-5915, a heap buffer over-read in libarchive's RAR v4 filter path. It includes a from-scratch RAR v4 encoder (build_encoder.py) that crafts archives to trigger the vulnerability, a script to modify existing archives (build_bigleak.py), a macOS interpose library (plant.c) to demonstrate memory disclosure, and an iOS application (RARLeak) that uses the system's vulnerable libarchive to exfiltrate heap memory on a real device. The primary operation is exercising the vulnerability to achieve controlled memory disclosure.

Backdoor review

No backdoor observed in reviewed code

The repository is a proof-of-concept (PoC) for CVE-2025-5915, a heap buffer over-read in libarchive. The supplied text files (README.md, writeup/cve-2025-5915.en.md, writeup/cve-2025-5915.it.md) describe the vulnerability, the methodology for reproducing it, and the analysis of the fix. They contain no instructions or code that would perform backdoor or deceptive actions against the person running the PoC. The described behavior (crafting RAR archives to trigger an over-read, using an iOS app to demonstrate the leak) is consistent with the stated goal of demonstrating the CVE. The binary files (RAR archives, compiled output, iOS project) are flagged as uninspected, but the text documentation provides no indication of concealed malicious payloads.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonCObjective-CMarkdown
Target softwarelibarchive
Attack typesheap buffer over-readinformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains multiple components that actively exercise the vulnerability to cause a heap over-read and exfiltrate memory, which is the definition of an exploit. The build_encoder.py script generates a malicious RAR archive from scratch to trigger the bug. The plant.c code and RARLeak iOS app are designed to demonstrate and measure the resulting memory disclosure. The writeup files are extensive technical analysis, but the presence of functional exploit code (the encoder, the interpose library, the iOS app) makes the primary classification 'exploit'.

README.md:3-6README.md:35-37writeup/cve-2025-5915.en.md:260-262writeup/cve-2025-5915.en.md:434-439

Requirements

  • A vulnerable version of libarchive (<= 3.7.9) must be used to process the crafted RAR archive.README.md:3-6writeup/cve-2025-5915.en.md:29-30
  • The attacker must be able to supply a crafted RAR v4 archive to the vulnerable libarchive instance.README.md:44-50

Observed behavior

  • Crafts a RAR v4 archive with a small declared uncompressed size (e.g., 16 bytes) to force a tiny LZSS window (32 bytes) and a large filter blocklength (e.g., 0x3C000) to trigger a heap over-read of up to ~240 KB.writeup/cve-2025-5915.en.md:260-277
  • Demonstrates that the out-of-bounds bytes read from the heap are included in the decompressed output, achieving memory disclosure.writeup/cve-2025-5915.en.md:223-254
  • On iOS 18.5, the provided app (RARLeak) dlopens the system libarchive, feeds it a crafted archive, and recovers ~150 KB of its own heap markers in the output, proving the vulnerability on a real device.writeup/cve-2025-5915.en.md:434-449
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability
CVE-2025-5915The entire repository is a PoC for this libarchive heap over-read vulnerability.README.md:1
File
poc/build_encoder.pyPython script to generate a malicious RAR v4 archive that triggers the over-read. This is the core of the PoC and is expected behavior.README.md:36
File
poc/RARLeak/An iOS Xcode project that demonstrates the vulnerability on a real device by using the system's libarchive. This is part of the documented PoC.README.md:39
Review boundaries

What the analysis did not establish

  • The evidence packet includes 12 binary files (RAR archives, a binary payload) that were not analyzed; their content is only known from metadata and the writeup's description.
  • The analysis is based solely on the provided text files (README.md, writeup files); the actual exploit code (Python, C, Objective-C) is not included in the text evidence, so its exact implementation cannot be verified from the supplied lines.
  • The classification relies on the writeup's claims about the behavior of the code, as the code itself was not executed or inspected beyond the text descriptions.
  • 12 binary files (RAR archives, compiled output, iOS project) were not analyzed and are flagged as BINARY. Their contents could not be reviewed for backdoors.
  • 40 other text files in the repository were omitted from the evidence packet and were not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1