CVE-2025-70305: 
NixOS vulnerability analysis and mitigation

CVE-2025-70305 is a stack-based buffer overflow vulnerability in the dmx_saf function (specifically safdmx_check_dur) of GPAC v2.4.0 that allows attackers to cause a Denial of Service (DoS) via a crafted .saf file. The vulnerability was published on January 15, 2026, by MITRE, with NVD initial analysis completed on January 23, 2026. Only GPAC version 2.4.0 is confirmed affected. It carries a CVSS v3.1 base score of 5.5 (Medium), assessed by CISA-ADP (Red Hat CVE, PoC GitHub).

The root cause is a missing bounds check in the safdmx_check_dur() function within src/filters/dmx_saf.c, classified as CWE-121 (Stack-based Buffer Overflow). The function declares a fixed-size stack array StreamInfo si[1024] indexed by nb_streams, but never validates that nb_streams < 1024 before writing a new entry. An attacker can craft a .saf bitstream containing more than 1024 unique stream_id values in Access Units that carry a ts_res field, causing an out-of-bounds write on the stack. The attack vector is local and requires user interaction — the victim must open or process the malicious .saf file with GPAC or a GPAC-based application. A public PoC including a Python generator script (gen_poc_saf_stack_oob.py) is available (PoC GitHub).

Successful exploitation causes the GPAC application to crash, resulting in a Denial of Service condition. The PoC author notes that because this is a stack out-of-bounds write, memory corruption may be exploitable beyond DoS depending on build flags and surrounding stack layout, though this has not been demonstrated publicly. There is no confidentiality or integrity impact confirmed; the primary impact is availability loss for the affected GPAC process (PoC GitHub, Red Hat CVE).

A public proof-of-concept exploit, including a Python PoC generator script, is available on GitHub and was added to NVD references on January 23, 2026 (PoC GitHub). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term (Red Hat CVE).

1. Craft a malicious .saf file: Use the public PoC Python script (gen_poc_saf_stack_oob.py) to generate a .saf bitstream containing more than 1024 unique stream_id values in Access Units, each carrying a ts_res field, to trigger the out-of-bounds write.
2. Deliver the file to the victim: Social-engineer the target user into opening the crafted .saf file using GPAC v2.4.0 or a GPAC-based application (e.g., via email attachment, file share, or download link).
3. Trigger parsing: When the victim opens the file, GPAC's SAF demuxer filter invokes safdmx_check_dur(), which iterates over the Access Units and writes stream entries into the fixed-size StreamInfo si[1024] stack array without bounds checking.
4. Stack overflow occurs: After the 1024th unique stream entry, subsequent writes overflow the stack buffer, corrupting adjacent stack memory and causing the application to crash (DoS). Depending on build configuration, further exploitation of the memory corruption may be theoretically possible (PoC GitHub).

• Process: Unexpected crash or termination of the GPAC process (gpac, MP4Box, or GPAC-based applications) when processing .saf files.
• File System: Presence of crafted .saf files with anomalously large numbers of unique stream IDs; presence of the PoC script gen_poc_saf_stack_oob.py on the system.
• Logs: Application crash logs or core dumps generated by GPAC referencing safdmx_check_dur or dmx_saf.c; OS-level segmentation fault or stack smashing reports associated with the GPAC process.
• Network: Downloads of .saf files from untrusted or external sources to systems running GPAC v2.4.0 (PoC GitHub).

No official patch from the GPAC project has been confirmed in the available data. Recommended interim mitigations include: (1) restricting .saf file processing to trusted sources only; (2) sandboxing or disabling SAF demuxer functionality if not required; (3) monitoring GPAC process crashes as potential indicators of exploitation attempts; (4) upgrading GPAC to a version newer than 2.4.0 when a patched release becomes available. The fix should add a bounds check in safdmx_check_dur() to ensure nb_streams < 1024 (or GF_ARRAY_LENGTH(si)) before writing new stream entries, or replace the fixed-size array with a dynamically sized structure (PoC GitHub, Red Hat CVE).

Red Hat has tracked this CVE in their security advisory database. No significant vendor statements, notable researcher commentary, or broad media coverage beyond the initial PoC publication and standard vulnerability database entries have been identified for this vulnerability (Red Hat CVE).