CVE-2025-64693: MaLion Security Point RCE Vulnerability

CVE-2025-64693 Overview

Security Point (Windows) of MaLion and MaLionCloud contains a heap-based buffer overflow vulnerability in processing Content-Length. Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege.

Critical Impact

A remote unauthenticated attacker can achieve arbitrary code execution with SYSTEM privileges by sending a specially crafted request exploiting the heap-based buffer overflow in Content-Length processing.

Affected Products

• MaLion Security Point (Windows)
• MaLionCloud Security Point (Windows)

Discovery Timeline

• 2025-11-25 - CVE-2025-64693 published to NVD
• 2025-11-25 - Last updated in NVD database

Technical Details for CVE-2025-64693

Vulnerability Analysis

This vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). The Security Point component in MaLion and MaLionCloud products for Windows improperly handles Content-Length header values in incoming HTTP requests. When the application processes a specially crafted Content-Length value, it fails to adequately validate the input before allocating heap memory, leading to a buffer overflow condition. Because the vulnerable service runs with elevated permissions, successful exploitation grants the attacker full SYSTEM-level access to the compromised Windows host.

Root Cause

The root cause lies in insufficient input validation when processing the Content-Length HTTP header. The application allocates a heap buffer based on the Content-Length value without proper bounds checking. When a malicious actor supplies a crafted Content-Length value, the subsequent data copy operation overflows the allocated buffer, corrupting adjacent heap memory structures and potentially overwriting critical control data.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can remotely send a malformed HTTP request with a specially crafted Content-Length header to the Security Point service. The heap-based buffer overflow allows the attacker to:

1. Corrupt heap metadata and control structures
2. Achieve arbitrary write primitives through heap manipulation
3. Redirect execution flow to attacker-controlled shellcode
4. Execute arbitrary commands with SYSTEM privileges

The vulnerability is particularly dangerous because the Security Point service runs with elevated privileges on Windows systems, providing immediate privilege escalation upon successful exploitation.

Detection Methods for CVE-2025-64693

Indicators of Compromise

• Unusual network traffic targeting the Security Point service port with malformed HTTP headers
• Crash dumps or unexpected service restarts of the MaLion Security Point service
• Process execution anomalies where SYSTEM-level processes spawn unexpected child processes
• Windows Event Log entries indicating heap corruption or access violations in the Security Point process

Detection Strategies

• Monitor network traffic for HTTP requests with abnormally large or malformed Content-Length header values
• Implement heap integrity monitoring for the Security Point service process
• Deploy endpoint detection rules to identify suspicious process creation chains originating from the Security Point service
• Configure SIEM rules to alert on repeated crashes or restarts of the Security Point Windows service

Monitoring Recommendations

• Enable detailed logging for the MaLion Security Point service to capture incoming request headers
• Monitor for unexpected SYSTEM-level process executions that deviate from normal operational baseline
• Implement network intrusion detection signatures for heap spray patterns and shellcode indicators in HTTP traffic
• Regularly review Windows Security Event logs for privilege escalation indicators

How to Mitigate CVE-2025-64693

Immediate Actions Required

• Apply the vendor security patch immediately as outlined in the Intercom Security Information Update
• Restrict network access to the Security Point service to trusted IP ranges only
• Enable enhanced monitoring and logging for the affected service
• Review system logs for any indicators of prior exploitation attempts

Patch Information

The vendor Intercom has released a security update addressing this vulnerability. Organizations using MaLion or MaLionCloud Security Point for Windows should consult the official Intercom Security Information Update and the JVN Advisory JVN76298784 for detailed patch information and update instructions. Apply the latest security patches as soon as possible to remediate this critical vulnerability.

Workarounds

• Implement network segmentation to isolate the Security Point service from untrusted networks
• Deploy a web application firewall (WAF) or reverse proxy to filter and validate Content-Length headers before they reach the service
• Consider temporarily disabling the Security Point service if not operationally critical until patches can be applied
• Enable Windows Defender Exploit Guard with heap protection policies for the affected process

# Example: Windows Firewall rule to restrict Security Point service access
netsh advfirewall firewall add rule name="Restrict MaLion Security Point" dir=in action=allow protocol=tcp localport=<SERVICE_PORT> remoteip=<TRUSTED_IP_RANGE>
netsh advfirewall firewall add rule name="Block MaLion Security Point Default" dir=in action=block protocol=tcp localport=<SERVICE_PORT>