CVE-2025-70298: 
NixOS vulnerability analysis and mitigation

CVE-2025-70298 is an off-by-one out-of-bounds read (and transient write) vulnerability in GPAC v2.4.0, specifically within the oggdmx_parse_tags function of the OGG demuxer filter (src/filters/dmx_ogg.c). It was discovered by researcher "zakka" on 2025-12-19 and published by MITRE on January 15, 2026. The vulnerability affects only GPAC version 2.4.0. It carries a CVSS v3.1 base score of 8.2 (High), assessed by CISA-ADP (Red Hat CVE, GitHub PoC).

The root cause is an off-by-one boundary check error (CWE-125: Out-of-bounds Read) in oggdmx_parse_tags(). The function reads a 32-bit tag length (t_size) from attacker-controlled OGG/OpusTags metadata and checks if (size < t_size) return;, which fails to handle the equality case (size == t_size). When size == t_size, the accesses sep = data[t_size] and data[t_size] = 0 read and write one byte past the valid buffer boundary (data[0..size-1]). The write is transient — the byte is set to 0x00 and then restored — but the OOB access is real relative to the function's size contract. A specially crafted OGG file with a malicious OpusTags comment can trigger this condition remotely with no authentication or user interaction required (GitHub PoC).

Successful exploitation can cause denial of service by crashing the GPAC application through undefined behavior triggered by the out-of-bounds memory access. The out-of-bounds read also creates a risk of information disclosure, potentially exposing one byte of adjacent memory content. Because the vulnerability is network-accessible with no authentication or user interaction required, remote attackers can easily submit malicious OGG files to trigger the flaw in any GPAC-based media processing pipeline (Red Hat CVE, GitHub PoC).

A public proof-of-concept exploit is available on GitHub, including a PoC OGG generator script (poc_offbyone.py) and GDB-based proof of the off-by-one write (GitHub PoC). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038%, reflecting low probability of near-term exploitation. The transient nature of the one-byte write limits straightforward weaponization, though denial-of-service remains a realistic attack outcome (Red Hat CVE).

1. Craft a malicious OGG file: Use the public PoC generator (poc_offbyone.py) to create a minimal OGG file containing an OpusHead and OpusTags block where the user comment length field (t_size) is set equal to the buffer size (size), triggering the off-by-one condition.
2. Deliver the file to the target: Submit the crafted poc_offbyone.ogg to a GPAC-based media processing service or application — via file upload, streaming endpoint, or any network-accessible interface that processes OGG media.
3. Trigger parsing: GPAC processes the OGG file and calls oggdmx_parse_tags(). With size == t_size, the check if (size < t_size) return; passes, and the code accesses data[t_size] — one byte past the valid buffer.
4. Achieve impact: The one-byte OOB read may disclose adjacent memory content; the transient OOB write (data[t_size] = 0 then restored) causes undefined behavior that can crash the application, resulting in denial of service. Run as: ./bin/gcc/gpac -i poc_offbyone.ogg -o null (GitHub PoC).

• File System: Presence of unexpected .ogg files with anomalous OpusTags metadata (comment length field equal to buffer size) in upload directories or media processing queues.
• Process: GPAC process (gpac) crashing or producing segmentation faults / abort signals when processing OGG input; core dump files generated by the GPAC process.
• Logs: Application logs showing GPAC crashes or errors during OGG demuxing, particularly referencing dmx_ogg.c or oggdmx_parse_tags; AddressSanitizer (ASan) reports if GPAC is built with sanitizers enabled.
• Network: Unusual or repeated submission of OGG files to GPAC-based media services from external sources, especially files with minimal or malformed OpusTags sections.

No official patch from the GPAC project has been confirmed as of the time of publication. The proposed code fix is to change the boundary check in oggdmx_parse_tags() from if (size < t_size) return; to if (size <= t_size) return;, which prevents the off-by-one access (GitHub PoC). In the interim, organizations should disable or restrict OGG file processing if not required, implement network-level controls to limit access to GPAC services, run GPAC with minimal privileges, and monitor for suspicious OGG file submissions. Upgrading to a patched version of GPAC once available is the recommended long-term remediation (Red Hat CVE).

Red Hat has acknowledged the vulnerability and published a CVE advisory page (Red Hat CVE). The vulnerability was noted in a cybersecurity digest covering high-CVSS CVEs published on January 16, 2026 (CyberHub Blog). Social media coverage has been limited, with brief mentions on Bluesky by security news aggregators. No significant vendor statements or notable researcher commentary beyond the original PoC report have been observed.