安全研究
CVE-2025-21298 Windows OLE RCE：CStdStubBuffer 加号偏移触发 Use-After-Free
Thinking
2025-01-22
3 分钟阅读
研究档案
#漏洞分析#代码审计#恶意软件
Windows OLE 把对象引用计数委托给 ole32!CStdStubBuffer_Disconnect 处理——攻击者通过 RTF 文档中精心构造的 OLE 引用，让引用计数在释放路径上加号偏移到特定值，引发双重释放与 Use-After-Free，配合 HEAP spraying 可劫持控制流。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9227687ce8823600cc05eab1aeba1041a7cc23041b3ac1510016305f33e04eec7406821d773c0b89d56a2020d607fa244dc0158e042c50b7fcacd44e0246a3460bf6c03213c80b37e025044a153e8883d06547d56146ac85faf547f69d46470386fa913f6149b08941017733999959916eea08f31b2d9e79910c5bd46020ca5db3f3702e440ae1daee244841dee4b16452b28e551358ff77469933dbe58c78fdb19d6db7073955286e87aa5e8f58cbdf5e9f43345014c09b27c6d5c9dcd5e0353c4a9a973d57957fe2897de4c2ad5506728ce60d428b6f58d71b82fce4bfb125625c8ff1315f87c7a9ae54068e82be72b2ec7d433f647f46d6b4b462a15792c447c7e33c38081db070c7eddaf2918088d2e0ea495f83f08d07d8714443fa4145a55c7c97f9f0c335ca61bacdd4c6c62c7c98eb44457f248652eb49d5b7db02fa2ad842a2d03b9a9d7681d4e1586f42a06400a5f6d4484ea21fd3d7477bc90d5acceb44e25b5ca529478ab2f6ad9dd410600fd88957753149232b580782336a0bee5cb084c4330781e70ec00ee77cfeaa75afe35e2140b123c0866244138c38b96824620cea2f106f645e6e92ab856b6f7e379c3bf59542d358bb6a2f7d66c0242c87ea01c4753a483d313914bf6668b9bb805c67a783eadfcb4b064a9b3e92f447de06a5bd91b1b39ea010b0e7398d44eb9783b696c081374252a45d593da368ca1067cfe3031bc3d9fffbeb412c2c8648128f11ea7d8a0b746a0cba09440eeb15936581d0ba49082f429feecef1c6988c59b26ba7e7ff33ca4adc034057e1234867b7a051534f381e7e94a6fb9f996ba682a66145b8aa5291514f953228ccd28382beb22eba3f68157f34bb89a797158c873e23e81c8e03246902ac637fbd0dde007177b3879a248b28cf8468d9e980ae69f0c7a08f104aa731511ab0220abcfb79d874ed28fd1a296fbeac6bcd3dccda9f79e2aacb25e1310a0161bad8e022e4d86386b69858e6aec8a248783f538ef9f138d9ad6b6aa9de64702cebef36b2af9b8dfb10b1464eba1d71edcc195b4d586c7294820f46ddce90d4ad59b538724c5b5d65cd12623edd8d5d315bdd5527833a6952925795ba5ef10c6d221815457732e0cd11fe8ec5644ddf5c9860f1a5c36e6a3cadb0aed88907769b0a4d043750a0ffb9c50452d12673322664e0d553a1205db79829b622e9aac8604a951e30d7d9e5224934fdfb4d080af47123387b0f647db8828121c90220670b71a992b31315c5c2e359bfb1848cb3ee86431211248c4750bc2d6ed1e07a77b339e2cf52190b6de88a0322514c97d84a1986d695974f3e9ca403d02fd303aa716d14ada2f4eb60063062bbb915d29e1da7ef695c7f7080636cf64ae9523d01f5e01aaba2ffb3a096c7ef5e9474c63adf459e3960b6ae4974df3e317fb2ebf0e00cbb58fcb50a3d6ff0ffaf0b069bf0a94982f738a30392c611dea853122dd2b9ac8ce230793c2beb315ef73b4deb3a336935370db91d0ebb41b264cbab8c6704128f2fd985a94570da59af75e735290a2bb3fef88a92b9aab0c83f654bb77e0eb46834cc1096a97d3f351dfa9a8540c824c945a7e795300b570d8b07464e25ba428205950fec664d6d55b66f9c1049e45d21c398a35bb52997b9e90de61bb735d74502a035a9365a569c3618f36f9150dbfa7cec9bbe8c41ce2ece9b24fa9c286794c910a3689ae6e0b36e5b1c2939ecdd456583b16a9e90777f76adc063b7f996cd38d5954bc49d0183aca07d9edea27ef566543c5e1cf66ae72585b5aeaa7bd4679cea58b5c136a1c7177a590e704602c646988119d7817ea42b5b61351471fec7291818b4189953064dd96dcda2f16bb68d591d693e5b60c52be6ddf852101eccdd330bd4e5777e9136f588201f93b8c057274dd786bac82c7eb1cdac0071517b5b5577d7d11857dbd66e308c2965824a34f3aea20c1a3d13f2f4862fc192d404d28219bb6cb7a51437d5022412182d408473b1a938cc82c9628361bb163eff54126d9d567ab8ed08d5992ca9db6151813a153175ed21e1882ea626051161f980f963974cd03d707a4f17ab725410097cc5a8b776dea8c090564c031491c3bef7ee8b86be1f7a26df2e0d54fd497245b133c95ae002c78246a725f8f519e020d5a3d399455c0168a818e3be6b789935a88ea036d9bdf8dbde85cc72ccdea2e3cd9ef5e47044e81cbeca305996152898dfff0fce2465feff018d305c2c81ca42baba69bd556b434698929c36bb8376763ac2bb26d06e48cb0e5de0c11b6fe4a5c3ce8176228ce918bb1d0e7394815bd55f7c11720f9dbb2b3089b34eec8b7a82987e85319c8ded3efe71126016a6aaa1d73a954e36b00068f94109446409860b068458bb59f6f421bae7cbba9effe9e10bf6dbd99ca0fc69b85e135d865813d49ffcae65c974e4e73af03775175e1bf0831c628378d221a69c1b1d1f9962e41810ec31df56fc5998d01b814d92d126b16f11fd9cfae24d6b94d328580a1385af2ed30d5df838b5b4e00e5178f597c9d7d4117236b6bedd3e3da3ab93dab9b5634ec12508ed33f473fcd450ffedcfb1004ca9bdca0bcbe109d357d07690468ec8063e904956eb35243bf7bc9ad328a9ac3c1ea1125a8da593e0135a4f78bf015aed8b0a744b055757bb3e5c6e297a3d008825b4a850a8173ec20c589d89ec841ccdf59308a6979c6a8d69d8e59f8bac51fdae3150c717ab6560262a319875f085b072de1e43072500cefed16a983d77efba724dd357430a7e965765517ddb37db74805cd0cd70cf110eb2b10cf22ede3275c6e5dea964a1664be1f8710038e7211afc9ed6c88d21ef747a37fd9a821c8ab1b728c757e3be6ad915fa99451ebef4551e167218e5ee0471f13cb26359efec63b8a1c44aa831e5fe2ddb5dd8c9a7160084bf7d7e48f478f9723f46ddd4bb8ec5d1e606cf034c4ad6bd90f37511e58464e471009ecedd561a2c817cf8371cb02ef59a108b5c277f0bbd1529886743f7dc2075b3af0e2ec2c1d4349d64fa37b414cf970f322e6a97b3389d60b1b2faba84d5cbf4e0007f10f623ef0c43c5e1cc0ae7128b37a5a8b11e077396a7ea79a7bd042aa91eb8b0e169180436a607d5080ef87193c99b12f50d845690a0086c486bc19233311ef141752c65a37c9fabd775ac8aa05fe1db76e196952ec24b87a47304a8ffa2c2d832e2e6a2094425992980ace66b918a8ffacb87d65a34c5650b080520ebb93898e25680219c208f8e56824dd9523d804225ba41f363d471d7102303a00ee4559c0923f23f4fabc98fa9afde5474e2d3df99d4b742b87a7fb7dee003ef012f14a2eff169cc2faf0ee36173f771b19c1596f4829cc0111599328fbc534cc1e494d2b27f9852388710f691f8973e9bd76b328ef299f29d6ff54e9934b3e2475c9a6a31acf4934288865f20e6370e2deabfa6982d61ebd399f981e6cfc0f9a8faeab626adb988720253757fae6ab91391c05851c260f346e0dc325d05f335d9ec11bf95d0b8b02175f2861b36577e51820c29a5243026f647818e9810bffa834a6747419c9aad62227c4b87d65341993afa578084656c0ccd79d7f91b8859e8b7d816364e7ebfc8d81aaa0f50a14fed8e1b16aeadabffade76cb642f5a4d405274c14bc0187512c0c3996e690c5116e71871307a03ee21f2522861ad7611fae024ae2c85c0241ebe30b814f088ad83b7906248e8296cb6361e700780f30d7dea4eeca51c20483bf061a2fdd4b4a3649645fe14e50dcaed7e530432707a04ab27c900a061151ab510c8828d8a95b36d619da228d9b1400a428c24ddca41545fc9e2203f9d949c0ce8e3a40dc80a3543719b22a3979b50cf9bc80b9c4ac4b8791bed74f44e8b80cb0db824adb7f05f1deaa08b630307c7e2b4e28cae2467f16b53abf4a905816396bcdac810ff4e1e529dc12d9da27dcbd7e06b730f71314cae38acf2e1c1894c8b9194ddc433804f44922e44b268df14eb4272deb69be66b245522dfd3e6583272e1982fe6875685cde1ea7e828b8792204ec0c8c9c2460a1ada13d5d77534918ed8c11cb9d9d430d36528cbe8aaf2d58d9cb3ab0ba485acb634ef64d8a85d859367705b51c6a46e7b3c29cc0b078e7baee339cb26fa879933fc8e79fb45e9a8da24dd4534d102379e61b6a092e2a28cba9d9fb56d6e1d9c3828783d2067a9240e4f9343566dd3d1d3495644acc23702ae30fc458a094b8b9073891d4de47c64530356216fb71795874571a5009a32375455d82aefc530220e70e9de005ffe9060fb002f29af71e24af4f9a71f8d8794ffe917768aede8e2377feaaaf169e4d1caf756fb23b8600290ddee7343eea0dc05a46011d8469b968fe590edcf290aa70c65d50f879befce67520a4969639c6808adc933dbb8f61adb3dd04f2d6366cf65e595c78fb9c4b1b203b0d5b6d4d440a22c238aa6b9f0ffda9324a9c13e5bc4637af48ed248633328c5e12ab5b652f1edc69e35e15cb1c9c45e984f1a2eb322448e0a00791d2d223cc4e5a778c5702000ae83e0869ffe7ce8ec2c8189415181dc07dcc954c97416c75c7979e2393a7636323ef6243214728ab38ec05b5e991c2240a5b77f30bc5cf47fd9ffe807e0fc3efada75a8bece33d8de968f626cf1650c709d85af6310309f0b3f246f5bd7a016e28b741aee219ca5d8157f8e211baa3c409c58fdc42a9bfdc8c510653c62713ff1ee814925a170a302d685d4ebb96b2a5ea3516a9945397a58ce6ce15802847cbe1a8cd4c3b9347d7e195683c5228f978c609d0fe757495629f831f7d5dab25b36c8cc86dccdd13b613a63878c1c2b32ee99286569daf2cb93e96fe72f01cda5cd6c72176926edc62896462f12c07eff02dcdb298e4dc73c8dfe3fdf6d5a66afa3284e3725fe76d0d04b0cbd2cf1b71c0a53fb42c2b6f60fb02d4e51a95c49dfe95d293c981dc350f0c23b07b8e2c1e254f812fca9f464dcf966b967727941998944cb025ae313fe31d71f30900cb91b7a4b9cac3fbcdc146fadc528bdfcb0cbb659db4c6da2591e8f9d2dbb592243fdd8054289e8c61a56e5480c8edb0bd587b42214514e24ea5a507574de2c74d3e927b09fef98315e2fc05c09ba3f32a9e92b66be5b043c9c8d592da3c394671f625477746dda159debb24d86e07bfa0f04321fd1f679950875e95cf59b42b57ce966ef1a40c47bbb23e5c0f0b2e725c0d1a08ce333e21748f61b184b4421784c6d502a28d13017df5898e6572c96ec9244119d27ea07ae76f3b0ecccc680aab16bb1e82671abfa72406201300152fc4fedf7987159d2c1089b4a7a55fb1db09fdc08ec0c72a2600abbe3b250219bd32a34a1b0e46afe2b4e0abab5ff444a3dd095b6ccbdac8509710c7843bbb40588a6c443f27c247f0f34f2efcf6acaafb09c00632774fa089bb710aebc5d40f2a6b2c125fa9a3687fddbf64a0413fd19c4a8099fe01efa473552983c5fd536d7f847d8c99cdefdf77d130f88daa69586a4ad7f3683ed62cbf796cc62509b09724ad602d501468fc88b554d10cc2343dd8a37a93c01f4dfbea2ae1b8d0305c2e5e530929031d2c46ff1b851c76f775559ebf73f40c5cd8300e461467bc9f6740ea4f3620dfa74f26f8937830837bafed6a3eaaab680498030f0335e88af4b482c4d4dad3e6cd93a2721484ec6b97e7fa411b5eb31cfb5b9ede5e28a22bf95e1ccd6dbe6f005a2cd607761d00d49e87e187817a964f8c7db9fd4044806089e99007223d027254e60f132bb19aac91ebc0c99dd4fbf53d218378571632e366c16a8118c8c0bfedaf090ddcf62304eaf2c70bd09c546f66483bdc623865b4944e18b96890806d96360ab083cf1eac801de76a28c698efb9f916a82309f689ac5530bc5a1e1f1cadd43b6577e7696b1d170ec50a51d0c9ce8ecae3053b1ddcd94043574414bb4fd37b089f67e1bbe7feed68b58b43fb29bf59125b30e21602462ec88db41f59e6ecf17039c084d8b4b4f293d1947072bb938913c7b702654ab7e8beeed90dcbde9747e4e53b95dd20e7092db17e38daf3a3933e79106ed5faec3d2e891eb0dd2cb44802edc76224a212c014f99f445755db604b09abc841d1fc34e249aa5e64eeaa0ebbc383cfcf5670285966413b9596194f5d609cac13ca9c18507f1cf4399de0f54011c5ae3f25f92374e2106bb22152b397efa43461f29cdf5f6544f784d648c1b973e0eb5f74e2ae7391e5c58cc4bd4cb37ca824a468a6526a2fbd67c63f689d26a13cbbfd19a57f41eeacb16e2618cd4269f8f8746c36b802ee2cb3e46e42cf961872cbaf8bfe99c042d2602b4e49cdfd2ab8e28148c09afd8403007dc25cd38cd6f40c0323e4659bb1a7f2b9f07b12eb486fff02a945206e84254928b3e7641b66fd6fe404173396c01977b5750149cf09dbf8477276a2055ed142cdbbfd024f1e64234339a5945994fb7a57b4c5f7d2e2a97b0bb32232165bddfa8518dc4b1f4e7b46c3d67935ddba3b48722b73e426272049d9f383fd6dd1945ed1dba13820a035ab4b7c8c29d3f8c841de5e1ebc3c5e50bced2544ad618a1ceb5ad53214b4447fb6f770f25978dc8d5181c5f05dee2304836884717673aa70b4aef84ad5bf2202e26f6f2b80855e935fd757f8ff214674f85e728b5935d10532f4e09f6a0359f0e4a1a4ecd9bdf3c4c90182ae250a6dfbd11fe84de62dfaae3298786e1f341a5cff72be844d6e416bf514e01dc38b33543c41648bc7228c2777331f0fc052896a228988dc8aa2ec856bc557bdaf286314d856bd57e716910dbbe6b327b3489505dc6b5847e4302486858b4e2914676c7adb50b48426014e301045465ddb4844aa68fc7e68630764dd30de62542469ca91be5b8c3fb1ec2c6093ef7f5e148253de5f14da112abbc9a32e8f88bbd3653d5ed92ecd4f00d2fb27618fa73e863f5a2d7846d2c29f10735b28e893d1fb9db896d736a7e7c2f2c5b81e57ec578e29343bc89468fff3669271746523d3fd4badb3dfbfc742ab7ddb33aaf24f499ae08af162c5f81ea5d0a29964bbbf05463af569f55dcfccc5f28fd9706e89dff847fd3bb1ecb60a17594764909176573230ecf8ed8cfd1f294880176a88bc0de09a820155ee036adcaed2ec74f57ab07bc7b2b56dc420be73b51cd19a3efbe12e2e4020a4e915dea377473fc07b8ea21575fdae0b2467874f273e90484bb7298dd00e463f76362944ca104f8c61b9e6d06e5dcefac07511d06d428e0d160a055e6df4500df0a9f47d0d66a2780e983a881fe290c18b3f3e340a1994dd6442ec54be1e97baee9c06455980790f9db337bff5eeb1c2cfbfaacf5448fa8460d497c153aa824bb82314038f8b0ad20a8a41a57dab9ba223610165245fa15f6479ca8dbe5772d4b5296b7b56af2194cabc79c1ebef546e564a95ffe9d0412a44436ba1b2f24f46d8c0ab5c795b578d8f3e73f00ce64b0071b4859d4b7f5103e52f2e65a19ab62312a50a9e5754ab65b7d22fbd69daef35ccbb1dc692e50b13b4d18823f7bf8499cbc3dd82d0f243a22193a91e2788bf183e159ffd95778bfa144a51999c5e5891e725b0c5a8b5a30fcf7843f86c8e07e1dfdc7bf0766223e29c3fe273b6c31bb5d2fa3f288dced4a48e94307ea01e204d4347cf46a630f5207fdb9ad1ae0d265dd597f6ccc155769bee7c95ed9bb3f3caf016a02e14ab73f63f86061326cab400172af8dded69987d9a38156bc924a78ce7c4f1ad375e5f50af071640e1b40cb1aa1e4a91e44414dd9bd6d34af522a160085d3babf8e3b4c73e0442138c26f0fa76163d0de742350d555702c18f8d2c64c013ae9a73add11a63381ce78c3ba48d2a368f62fe073ce32c834e31697ba1a2be37fc218460505f4428022dfc5fe4c794bd70c6cd2407d6ae830f7229d89436a1b07e443b76193078c78ba92c18df98adafcd298525f6e2cbfcce6f860401730b1daa2176ac94d6ec75e889597a687fbcef42aff4cbf807c4a47026b637a04e107b9988df7999e25bb0af4ea21d69a699e124cee802e2232d0f9df58fa7691f9ca9156c8005133093aee42a5877d9574797b3f24821af6756ecb32c82f2ade14df8a808ae1fddb250b32d19ac8386eb315c5e518f094417b27bdc06df471ec26e7a25761d93ea554530a2fb2563359ee067a95430281b6e8c0a244c7fe665831b12630a9ad790ce3022de1024dc87cf3122961b7b18e36df524b0f3e19bc8c787a89f1390ed7ff9cf7e4196827364b00ce6094bf0ba453c362a20ff0018f863cf3383105843c96c245de91d350459b9c5623958c6bf719745bbf1afdda654cebb803ebede6b0b352d3834870952df80a619a1ec7d6b68dbe0538eac4812d0af5095c28b57859ff106a5e1ed9dc3267407f6eecc279a84ab46004f1bdd323cde59f16c8fe28c8cd7af4e775d4d831c8470d5fe96b68533ce9f1e1f117c785cd49d4875330a8361c6c470e80c1b6068b5540492a5e6322a285f3a3a12954e5fb3d2968b8f44065d9e475d05e3ebc8da543cd7cd8644735192c69c17bfaeeaf7e042906723416eeb6ee7c19755f0e329797c387df7e9fb068bcf9d4e70f36e089849b6f3b709c71edb3345107a32827a2fa8a30e4984aaa6f835fec8f7c503c1c7cc65cf5cf996a67e320f6bcf5827c4df80a33425648c7c4b9a3eb6ea3b693c01f044df3c5b75959736f692aa632c26e48e58190dd298560c31cadb7e722762ee84af447cd999bc92c9214385e82a5697570c539b0db3f69fce6d19b02c8b689aeced80cbfde12302c996acbf5794907602a64dfea004ad7f44cfb5dd6f557751c6f41e2cdafb00dee2750fe259e51f4bee98b4436c2f1860a83ca389444e9f9a637c15b52d64e08258b48107689a1d688d98578e7efb670fb2ae2e0e154febb978beb8de23b48a3c0e2a90c101fffc2663b0392b7c7c47655f038aac72b345d47bcd4f0abf10f5a8d467b695fed4c28870836c6a96bad7c029bea9ed59082d20e5f9a99e669ad5d2efbd79689a1585d837dfcea1ba902b145711cecf65674e84dc8fbc5a78e6d818bfeff783f83bcfd812dbc4b2571bfd691964082bff69367985193050eb8b77de93b76a363206f3c9e13fe00fccc92eccc00913c7c45396d9b1bd02f526f19bb0552f1f5b15b3afe329df67c2fc4ec3caf2f4e32ab94298813f7404b2cfac9a81deb3cab306161254d6d3aa45bedc5150bd14a65c730f048ed5156d05e2c907e9f49738052da9dbfe6ba9056262ed33e4abff5556cb62e74c0c1bb50924e20925eab014bf885a75636bac14d1cae0732fb949091e98352ce487607dd691f9c826bf6f1015a01d939dc09142c99caa800d012d55083a7cec3600871fe8b75f7cbf76d4d895ba402342ee2a490f29dec8bcec41e5cfea39e25041f99abdea12771aa3140d1d2a020afef934775419f903ae2e09fcb88e5c91ebb7927bf280c881de080c4d27e6dc1aac4610fb30f5fa04e8676b15be7bf9a91ad4f1a24f17ee023fdc8d7257e0e0370782ed321764983a74045fa4e95fd5936f902660ae9e01a9ad9b911c6f9917d5bf7e5b9ce08fac2297af9f3ee45e4fe0e2d3ce4831a377d4b10d74c226c138fae9ab99907e8ddd09f6fcd72a645483967e18e5515bfd1ef9690c90b8ee296a7df1120cf1b85fb77a7b6f66aece17458ac34754b8d594556f78772596018693898101f5df8911b286bab246da8bf568691f9f01343f1289b26f99fede8479ce492dc5393a8b6c4e56c7d369cfb488979d6de2119e3ec9dbcc0c410ff36981f1fb847b04393fdb36040bdafa66cededfa2258771d5ea1b81a088463003a6365c2f5fda3846d1919c3706b14fbfd6ccfd45fb36752b015ccd2b3012645f126a522875b6a7f3186064ecd89b846ae952af1c6adbaacdb8d0728bdc2c9936e1059ba6a09917b07da3220cb5af6e4f9813ffde21679c38f15d84f0b25a200ebc2ce16396e1e36b14ead7f694be607e82ca1852ddbbf58fca1a065e399a709e254ea54231b6d72d18dd91642c23c07f4e1d76f927638817caa8379929a53b6a987fc38aaf5976331a7763693918c16d28415730cca7553cf0dc4df83968e37be7e552d47e0a600dedf44b11cdf52652a9ea5c5f47f7cced05ed0fdcb6e3ca76925ccd76df2f5f154aa1f401aad0e818e7fea279d9f710adb85d6edbd0ea292131bde5e0536ae65511020cd22d3afc05d14cefc64d2821bb23122c13d12040d366fe1ddb3b75eb37f7e82e5d0a011a0848c5ca5103d16428219be064ddb57d2f05568942561eebd50bcdd80c5fdfcffb1219e177b6c422b35b8b731abb5a2bd71fab5de23976c1fc76cae1842d49d566a0ea53a1e2c89ffd81d37e8f5add75b469e57baf9cf27c150eb128e0431de66a8914811381f83b0bdf412b93c9385c2ade77daba324b3ff84e587dc1cce23ca908c047f85b5077540fb3ec414393668389008f11628a2bf7053eba8f82e5d32bca8afd3923820f766566857b56d7a8575d211db4f2bc357de5c926fc04a5817770588f021d681f1478cfac3a1656320b5e4399f6e008be7b0c0030b6e9fd6ed417e6e8f45a2f018990d12fec58773ec6bfd82b203ea01e0ce3fb88e1eec7ddb735c