CVE-2025-70303: 
NixOS vulnerability analysis and mitigation

CVE-2025-70303 is a heap-based buffer overflow vulnerability in the uncv_parse_config() function of GPAC v2.4.0 that allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. The vulnerability was received by MITRE on January 15, 2026, and initially analyzed by NIST on January 23, 2026. It affects GPAC version 2.4.0 specifically, in the UNCV decoder filter component. The CVSS v3.1 base score is 5.5 (Medium), assessed by CISA-ADP (Red Hat Advisory, PoC Report).

The root cause is an incorrect 2D array indexing stride in the cpat (component pattern) box parsing logic within src/filters/dec_uncv.c (CWE-122: Heap-based Buffer Overflow). The code allocates fa_map as a fa_width * fa_height grid of u16 elements, but writes into it using j + i * fa_height instead of the correct j + i * fa_width. When fa_height > fa_width (e.g., fa_width=1, fa_height=2), the computed index exceeds the allocated buffer, causing a heap out-of-bounds write of a u16 value derived from attacker-controlled file input. Exploitation requires a victim to open or process a specially crafted MP4/ISOBMFF file with GPAC or a GPAC-based application (PoC Report).

The primary confirmed impact is a Denial of Service — the GPAC process crashes when parsing the malicious MP4 file. Because the vulnerability is a heap out-of-bounds write with attacker-influenced data, the PoC author notes that further exploitation (e.g., arbitrary code execution) may be possible depending on heap layout and subsequent allocations, though a full exploitability assessment has not been published. The attack is local and requires user interaction, limiting the blast radius to the affected user's session and any GPAC-based application processing the crafted file (PoC Report, Red Hat Advisory).

A public proof-of-concept exploit is available on GitHub, including a minimal crafted MP4 file (poc_uncv_cpat_oobwrite.mp4) and reproduction instructions using an AddressSanitizer-enabled GPAC build. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), reflecting very low probability of exploitation in the near term. No threat actor attribution has been reported (PoC Report, Red Hat Advisory).

1. Craft the malicious MP4 file: Create a minimal MP4/ISOBMFF file containing a UNCV decoder configuration box (cpat) with fa_width=1 and fa_height=2 (or any configuration where fa_height > fa_width). The PoC file poc_uncv_cpat_oobwrite.mp4 demonstrates this.
2. Deliver the file to the victim: Social-engineer the target user into opening the crafted MP4 file using GPAC or a GPAC-based application (e.g., via email attachment, file share, or malicious download link).
3. Trigger parsing: When the victim opens the file, GPAC's UNCV decoder filter (uncvdec) parses the cpat box in uncv_parse_config(), triggering the incorrect index computation (j + i * fa_height instead of j + i * fa_width).
4. Heap out-of-bounds write occurs: The out-of-bounds write of a u16 value corrupts heap memory beyond the allocated fa_map buffer, causing at minimum an application crash (DoS). Depending on heap layout, further memory corruption effects may follow.
5. Verify with ASan (researcher context): Run ASAN_OPTIONS=abort_on_error=1 ./bin/gcc/gpac -i poc_uncv_cpat_oobwrite.mp4 uncvdec inspect:deep to confirm the heap-buffer-overflow WRITE of size 2 at uncv_parse_config filters/dec_uncv.c:402 (PoC Report).

• Process: Unexpected crash or termination of the gpac process or any GPAC-based application immediately after opening an MP4 file.
• Logs: AddressSanitizer output (if enabled) reporting heap-buffer-overflow WRITE of size 2 in uncv_parse_config at filters/dec_uncv.c:402; application crash logs or core dumps referencing uncv_parse_config or uncvdec.
• File System: Presence of unexpected or externally sourced MP4 files with unusual UNCV/ISOBMFF box structures (e.g., cpat box with fa_width < fa_height); core dump files generated by the GPAC process.
• Network: Downloads of MP4 files from untrusted or unexpected sources to systems running GPAC 2.4.0 (PoC Report).

No official patch from the GPAC project has been confirmed as of the time of reporting; organizations should monitor the GPAC project for security updates and upgrade beyond version 2.4.0 when available. As interim mitigations: restrict processing of MP4 files to trusted sources only; run GPAC applications under restricted user accounts with minimal privileges; use file validation or sandboxing before processing media files; and monitor systems running GPAC 2.4.0 for unexpected crashes. Nessus detection ID 287954 can be used to identify vulnerable installations (Red Hat Advisory, PoC Report).

Red Hat has published a security advisory tracking this CVE. No significant public researcher commentary, vendor statements beyond Red Hat's tracking, or notable media coverage has been identified for this vulnerability (Red Hat Advisory).