CVE-2025-70302: 
NixOS vulnerability analysis and mitigation

CVE-2025-70302 is a heap-based buffer overflow vulnerability in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0, a widely used open-source multimedia framework. The flaw allows local attackers to cause a Denial of Service (DoS) via a crafted input file. It was published on January 15, 2026, by MITRE, with NVD initial analysis completed on January 23, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), assessed by CISA-ADP (Red Hat CVE, PoC Report).

The root cause is a heap-based buffer overflow (CWE-122) in the GHI demuxer filter (filters/dmx_ghi.c). When parsing properties of type GF_PROP_VEC2I_LIST (Vector 2 Integer List), the code reads the number of items (nb_items) and allocates memory sized as sizeof(u32) * nb_items (4 bytes per item), but subsequently writes two 32-bit integers (x and y) per item — effectively doubling the required buffer size. This mismatch causes a heap out-of-bounds write, which can crash the application or potentially enable code execution. Exploitation requires local access and user interaction (i.e., opening a crafted input file), with no privileges required (PoC Report).

Successful exploitation results in high availability impact — the GPAC application crashes due to the heap out-of-bounds write. There is no confidentiality or integrity impact associated with this vulnerability under the current CVSS assessment. While the primary documented consequence is DoS, the PoC author notes potential for code execution in more advanced exploitation scenarios (PoC Report, Red Hat CVE).

A public proof-of-concept (PoC) exploit is available on GitHub, published by researcher zakkanijia and referenced by NVD as of January 23, 2026. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is extremely low at 0.013%, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is detected by Nessus (plugin ID 287963) (PoC Report, Red Hat CVE).

1. Reconnaissance: Identify systems running GPAC v2.4.0 locally, particularly those that process untrusted or user-supplied media files using the GHI demuxer filter.
2. Craft malicious input: Create a binary GHI file that specifies a property of type GF_PROP_VEC2I_LIST with a crafted nb_items value designed to trigger the undersized memory allocation in ghi_dmx_declare_opid_bin().
3. Trigger processing: Induce the target user or process to open the crafted file with GPAC (e.g., via gpac -i malicious.ghi), causing the GHI demuxer filter to parse the malicious property list.
4. Heap overflow triggered: The application allocates sizeof(u32) * nb_items bytes but writes two 32-bit integers per item, overflowing the heap buffer and causing an application crash (DoS) or potentially enabling further memory corruption (PoC Report).

• File System: Presence of unexpected or suspicious .ghi binary files in directories accessible to GPAC; files with anomalous GF_PROP_VEC2I_LIST property structures.
• Process: Unexpected crashes or core dumps of the gpac process; repeated application termination when processing specific input files.
• Logs: Application crash logs or core dump files referencing ghi_dmx_declare_opid_bin in stack traces; heap corruption error messages from the GPAC runtime.

No official patch from the GPAC project has been confirmed as of the time of publication; users should monitor the GPAC project for security updates. In the interim, restrict local access to systems running GPAC v2.4.0 and avoid processing untrusted or externally sourced GHI files. Apply the principle of least privilege to accounts running GPAC, implement input validation for files processed by the application, and consider alternative media processing tools if GPAC is not essential (Red Hat CVE, PoC Report).