Headline
Logitech Streamlabs Desktop 1.19.6 (overlay) CPU Exhaustion
A vulnerability exists in Streamlabs Desktop where importing a crafted .overlay file can cause uncontrolled CPU consumption, leading to a denial-of-service condition. The .overlay file is an archive containing a config.json configuration. By inserting an excessively large string into the name attribute of a scene object within config.json, the application’s renderer process (Frameworks/Streamlabs Desktop Helper (Renderer).app) spikes to over 150% CPU and becomes unresponsive. This forces the victim to terminate the application manually, resulting in loss of availability. An attacker could exploit this by distributing malicious overlay files to disrupt streaming operations.
Title: Logitech Streamlabs Desktop 1.19.6 (overlay) CPU Exhaustion
Advisory ID: ZSL-2025-5967
Type: Local/Remote
Impact: DoS
Risk: (2/5)
Release Date: 13.11.2025
Summary
Streamlabs Desktop is a free streaming and recording software, built on OBS Studio, for content creators to stream live to platforms like Twitch, YouTube, and Facebook. It is designed to be beginner-friendly and offers tools for creating engaging streams, such as customizable overlays, alerts for viewer interactions, and the ability to add guests to a stream.
Description
A vulnerability exists in Streamlabs Desktop where importing a crafted .overlay file can cause uncontrolled CPU consumption, leading to a denial-of-service condition. The .overlay file is an archive containing a config.json configuration. By inserting an excessively large string into the name attribute of a scene object within config.json, the application’s renderer process (Frameworks/Streamlabs Desktop Helper (Renderer).app) spikes to over 150% CPU and becomes unresponsive. This forces the victim to terminate the application manually, resulting in loss of availability. An attacker could exploit this by distributing malicious overlay files to disrupt streaming operations.
Vendor
Logitech | General Workings, Inc. - https://www.logitech.com | https://www.streamlabs.com
Affected Version
1.19.6
Tested On
macOS Sequoia version 15.7.2, 15.7.2
Microsoft Windows 11 25H2
Microsfot Windows 10
Vendor Status
[15.10.2025] Vulnerability discovered.
[15.10.2025] Vendor contacted.
[15.10.2025] Vendor’s security submission through h1 does not work.
[16.10.2025] Vendor communication tried again.
[16.10.2025] Vendor’s security submission through h1 does not work.
[13.11.2025] Public security advisory released.
PoC
logitech_streamlabs_cpu.py
Credits
Vulnerability discovered by Gjoko Krstic - <[email protected]>
References
[1] https://packetstorm.news/files/id/211594/
Changelog
[13.11.2025] - Initial release
[15.11.2025] - Added reference [1]
Contact
Zero Science Lab
Web: https://www.zeroscience.mk
e-mail: [email protected]