shinigami-777/poc_cve-2025-11579Proof-of-concept exploit for CVE-2025-11579, a denial-of-service vulnerability in rardecode that triggers an out-of-memory crash via a crafted RAR file with an oversized dictionary size.
rardecode versions <= 2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
We craft a RAR file with an artificially large dictionary size causing the library to attempt massive memory allocations and then have an Out of Memory Crash.
Use the 14Gb.rar file and do go run exploit.go.
Use the normal simple.rar provided and run the exploit. It is successfully extracted.
