CVE-2025-70299: 
NixOS vulnerability analysis and mitigation

CVE-2025-70299 is a heap-based buffer overflow vulnerability in the avi_parse_input_file() function of GPAC v2.4.0 that allows attackers to cause a Denial of Service (DoS) via a specially crafted AVI file. The vulnerability was received by NVD from MITRE on January 15, 2026, with initial analysis completed on January 30, 2026. Only GPAC version 2.4.0 is confirmed affected, though additional versions may also be vulnerable. It carries a CVSS v3.1 base score of 6.5 (Medium), assessed by CISA-ADP (Red Hat Advisory, PoC Report).

The root cause (CWE-122: Heap-based Buffer Overflow) lies in GPAC's OpenDML AVI demuxer (media_tools/avilib.c) during parsing of the indx (SuperIndex) chunk. The code allocates a buffer sized as wLongsPerEntry * nEntriesInUse * sizeof(u32), but then writes fixed-size 16-byte SuperIndex entries (4 DWORDs: qwOffset, dwSize, dwDuration) regardless of the wLongsPerEntry value. When a crafted AVI file specifies a wLongsPerEntry value less than 4 (e.g., 2), the allocation is undersized and subsequent writes go out of bounds on the heap. The vulnerability is reachable via standard AVI demuxing — no API misuse is required — and is confirmed reproducible with AddressSanitizer reporting a heap-buffer-overflow WRITE of size 4 at avilib.c:2204 (PoC Report).

Successful exploitation causes a reliable application crash (Denial of Service), disrupting availability for any user or service relying on GPAC for AVI media processing. The heap out-of-bounds write also introduces memory corruption that, depending on heap layout and allocator behavior, could theoretically be leveraged for code execution, though this was not demonstrated in the published PoC. Confidentiality and integrity are not directly impacted under the current CVSS assessment, and the scope is limited to the affected GPAC process (PoC Report, Red Hat Advisory).

A public proof-of-concept (PoC) exploit is available on GitHub, including a Python script (gpac_avi.py) that generates a malicious AVI file (poc_avi_indx_wLongsPerEntry_2.avi) to trigger the crash. Exploitation requires user interaction — a victim must open the crafted AVI file with GPAC or an application using GPAC's AVI demuxer — but can be initiated remotely over a network. There is no evidence of in-the-wild exploitation at this time, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.034% (0.000340), indicating a low probability of exploitation in the near term (PoC Report, Red Hat Advisory).

1. Craft malicious AVI file: Use the publicly available Python PoC script (gpac_avi.py from the researcher's GitHub repository) to generate a malicious AVI file (poc_avi_indx_wLongsPerEntry_2.avi) containing an OpenDML indx SuperIndex chunk with wLongsPerEntry set to 2 (or another value less than 4) and at least one entry.
2. Deliver the file: Distribute the crafted AVI file to the target via email attachment, file sharing, a malicious web page, or any other social engineering vector that prompts the victim to open the file.
3. Trigger parsing: The victim opens the malicious .avi file using GPAC (e.g., gpac -i poc_avi_indx_wLongsPerEntry_2.avi:ext=avi avidmx inspect:deep=true) or any application that uses GPAC's AVI demuxer internally.
4. Heap overflow triggered: GPAC's avi_parse_input_file() in media_tools/avilib.c allocates a buffer based on the undersized wLongsPerEntry value, then writes 16-byte fixed-size entries beyond the allocated buffer boundary, causing a heap-buffer-overflow write.
5. Achieve DoS: The out-of-bounds write causes an application crash (confirmed via ASAN), resulting in a Denial of Service condition (PoC Report).

• File System: Presence of unexpected .avi files with anomalous indx chunk structures (small wLongsPerEntry values such as 1 or 2); presence of gpac_avi.py or poc_avi_indx_wLongsPerEntry_2.avi on the system.
• Process: Unexpected crashes or abnormal termination of the gpac process or applications embedding GPAC's AVI demuxer; crash dump files generated by the OS following GPAC process termination.
• Logs: Application crash logs or core dumps referencing avi_parse_input_file or avilib.c; ASAN output containing heap-buffer-overflow in avi_parse_input_file media_tools/avilib.c:2204 if GPAC is built with sanitizers enabled.

No official patch from GPAC has been confirmed in the available vulnerability data. The PoC researcher suggests the following code-level fixes: validate that wLongsPerEntry equals 4 for OpenDML SuperIndex entries (rejecting files where it is less than 4), add bounds checks ensuring the indx chunk has sufficient bytes for nEntriesInUse * 16, and allocate buffers using the real entry structure size rather than wLongsPerEntry. Until a patch is available, users should avoid opening AVI files from untrusted sources with GPAC, restrict AVI processing in environments where untrusted media may be encountered, and consider isolating systems running GPAC. Organizations should monitor the GPAC project for upstream fixes (PoC Report, Red Hat Advisory).

Red Hat has acknowledged the vulnerability and published a security advisory tracking CVE-2025-70299. No significant broader community commentary, vendor statements beyond Red Hat, or notable media coverage has been identified at this time (Red Hat Advisory).