Heap Buffer Overflow in libpng png_image_finish_read

This repository is a Capture-The-Flag (CTF) style exploit challenge for CVE-2025-65018, a memory corruption vulnerability in libpng's simplified API when handling 16-bit interlaced PNG images. The repository contains: - A vulnerable C binary ('victim.c') that reads a PNG file ('exploit.png') into a stack-allocated buffer, followed by a Logger structure with a function pointer. - A Python script ('solve.py') that generates a malicious PNG file designed to exploit the buffer overflow and overwrite the Logger's function pointer with the address of a 'win' function, which spawns a shell. - Build scripts and a patched version of libpng to ensure the vulnerability is present. The exploit works by carefully crafting the pixel data in the PNG so that, when processed by the vulnerable libpng, it overflows the buffer and overwrites the function pointer. The attack is local, requiring the attacker to supply a crafted PNG file to the vulnerable binary. The repository is well-documented, with detailed explanations in 'Blog.md' and 'README.md', and includes automation for building and testing the exploit. No network endpoints are involved; the main fingerprintable targets are the file paths ('exploit.png', '/bin/sh') and the memory layout of the target binary.

This repository provides a proof-of-concept (PoC) exploit for CVE-2025-65018, a heap buffer overflow vulnerability in libpng as used on PlayStation 4 and PlayStation 5. The repository contains three files: a LICENSE (Apache 2.0), a README.md with usage instructions, and make_png.py, a Python script that modifies a valid PNG screenshot to create a malicious PNG file. The exploit workflow involves taking a screenshot on the PS4/PS5, transferring it to a PC, running the script to generate a crafted PNG, and then replacing the original screenshot on the console. When the crafted PNG is opened in the gallery, it triggers the vulnerability, resulting in an error or crash. The exploit does not provide remote code execution or a shell, but demonstrates the vulnerability by causing a crash. The only fingerprintable endpoint is the file path used for screenshots on the console. The code is a standalone PoC and not part of any exploit framework.