CVE-2025-70304: 
NixOS vulnerability analysis and mitigation

CVE-2025-70304 is a heap-based buffer overflow (out-of-bounds read) vulnerability in the vobsub_get_subpic_duration() function of GPAC v2.4.0, a widely used open-source multimedia framework. The flaw allows unauthenticated remote attackers to cause a Denial of Service (DoS) by supplying a crafted VobSub subtitle file (.idx/.sub pair). It was published on January 15, 2026, with initial analysis completed by January 23, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Red Hat CVE, GitHub PoC).

The root cause is a missing bounds check on the attacker-controlled dsize field in the VobSub demuxer filter (src/filters/dmx_vobsub.c), classified as CWE-121 (Stack-based Buffer Overflow, though the actual behavior is a heap out-of-bounds read). In vobsubdmx_send_stream(), two 16-bit values psize and dsize are read from the .sub data stream; psize controls the heap allocation size for the packet buffer, while dsize is passed unvalidated to vobsub_get_subpic_duration() in src/media_tools/vobsub.c. When dsize >= psize - 1, the function reads a 16-bit value from packet[dsize] and packet[dsize+1], going past the end of the allocated heap buffer. A crafted file with psize = 0x20 (32 bytes) and dsize = 0x1F (31 bytes) triggers a one-byte out-of-bounds read at packet[0x20], confirmed via AddressSanitizer (GitHub PoC).

Successful exploitation causes GPAC or any GPAC-based application to crash, resulting in a Denial of Service condition. The primary demonstrated impact is an application crash (loss of availability); confidentiality and integrity are not directly affected, though the out-of-bounds read theoretically introduces a risk of information disclosure depending on how the read value is subsequently used or exposed. Systems or services that process user-supplied subtitle files using GPAC v2.4.0 are at risk, including media processing pipelines and streaming applications (GitHub PoC, Red Hat CVE).

A public proof-of-concept exploit is available on GitHub, including a Python script (gpac_idx.py) that generates crafted .idx and .sub files to trigger the vulnerability (GitHub PoC). The vulnerability requires no authentication, no user privileges, and no user interaction beyond opening a malicious subtitle file, making it straightforward to exploit over the network. The EPSS score is approximately 0.023% (very low probability of exploitation in the wild), and there is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft malicious VobSub files: Use the publicly available PoC generator script gpac_idx.py to create a crafted subtitle pair: python3 gpac_idx.py --out poc_vobsub --psize 0x20 --dsize 0x1f, producing poc_vobsub.idx and poc_vobsub.sub with psize=0x20 (32 bytes) and dsize=0x1F (31 bytes).
2. Deliver the malicious files: Supply the crafted .idx/.sub pair to a target system running GPAC v2.4.0 — for example, by hosting them on a web server, embedding them in a media package, or submitting them through an application that accepts subtitle uploads.
3. Trigger processing: Cause the target to open or process the crafted VobSub subtitle file, e.g., via gpac -i poc_vobsub.idx inspect:deep. GPAC's VobSub demuxer filter reads the attacker-controlled psize and dsize fields from the .sub PES header.
4. Trigger out-of-bounds read: The unvalidated dsize value causes vobsub_get_subpic_duration() to read one byte past the end of the allocated heap buffer at packet[0x20], triggering a heap-buffer-overflow and crashing the application (GitHub PoC).

• File System: Presence of crafted .idx and .sub VobSub subtitle files with anomalous psize/dsize field values (e.g., dsize >= psize - 1); PoC generator script gpac_idx.py on disk.
• Logs: Application crash logs or core dumps originating from the GPAC process, particularly referencing vobsub_get_subpic_duration in media_tools/vobsub.c or vobsubdmx_send_stream in filters/dmx_vobsub.c; AddressSanitizer output indicating heap-buffer-overflow READ at vobsub.c:492.
• Process: Unexpected termination or crash of GPAC or GPAC-based media processing processes after ingesting subtitle files; repeated process restarts in automated media pipelines.

No official vendor patch has been confirmed for GPAC v2.4.0 at the time of publication; users should monitor the GPAC GitHub repository for security updates and upgrade as soon as a patched version is released. As an interim measure, restrict access to services that process user-supplied VobSub subtitle files and implement network segmentation to limit exposure. Avoid processing untrusted .idx/.sub subtitle files with GPAC v2.4.0, and consider disabling the VobSub demuxer filter if not required (Red Hat CVE, GitHub PoC).

Red Hat has acknowledged the vulnerability and published a CVE advisory page (Red Hat CVE). The vulnerability received brief coverage from security news aggregators including The Hacker Wire and was noted in CISA's weekly vulnerability summary for the week of January 12, 2026. Community reaction has been limited, consistent with the low EPSS score and absence of active exploitation.