CVE-2025-70307: 
NixOS vulnerability analysis and mitigation

CVE-2025-70307 is a stack-based buffer overflow vulnerability in the dump_ttxt_sample function of GPAC v2.4.0 that allows remote attackers to cause a Denial of Service (DoS) via a crafted MP4 file. The vulnerability was assigned by MITRE and published on January 15, 2026, with initial NVD analysis completed on January 30, 2026. Only GPAC version 2.4.0 is confirmed affected, though other versions containing the same dump_ttxt_sample logic may also be vulnerable. It carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Red Hat Advisory, PoC Report).

The root cause is a missing bounds check in src/isomedia/box_dump.c within the dump_ttxt_sample function (CWE-121: Stack-based Buffer Overflow). The function allocates a fixed 20,000-byte stack buffer (unsigned short utf16Line[10000]) and performs an unchecked memcpy from a timed-text sample when the payload begins with a UTF-16 BE BOM (0xFE 0xFF): memcpy((char*)utf16Line, s_txt->text + 2, s_txt->len). Because s_txt->len is attacker-controlled via the tx3g sample's 16-bit length field, supplying a value greater than 20,000 bytes causes the copy to write past the end of the stack buffer, corrupting the stack. Exploitation is triggered when a victim processes a crafted MP4 file using MP4Box -ttxt or any GPAC code path that dumps timed-text tracks (PoC Report).

Successful exploitation causes at minimum a Denial of Service through a crash of the GPAC process when processing a malicious MP4 file. Because the vulnerability is a stack out-of-bounds write (memory corruption), there is a theoretical risk of code execution depending on build flags, compiler mitigations, and stack layout, though this has not been demonstrated publicly. The vulnerability requires no authentication or user interaction beyond processing a crafted file, and the availability impact is rated HIGH with no confidentiality or integrity impact under the current assessment (PoC Report, Red Hat Advisory).

A public proof-of-concept (PoC) exploit is available on GitHub, including a Python script (poc_tx3g_utf16_stack_overflow.py) that generates a crafted MP4 file to trigger the overflow, along with AddressSanitizer output confirming the stack-buffer-overflow at box_dump.c:3605. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.023% (0.000230), indicating a low probability of exploitation in the near term. The vulnerability is detectable via Nessus plugin ID 287953 (PoC Report, Red Hat Advisory).

1. Craft a malicious MP4 file: Use the public PoC generator script (poc_tx3g_utf16_stack_overflow.py) to create a minimal MP4 file containing a tx3g timed-text sample with text_len = 30000 and a payload starting with the UTF-16 BE BOM (0xFE 0xFF).
2. Deliver the file to the target: Social-engineer a victim into processing the crafted MP4 file, or place it in a location where an automated GPAC-based pipeline (e.g., media transcoding service) will process it.
3. Trigger the vulnerable code path: The victim (or automated process) runs MP4Box -ttxt 1 poc_tx3g_utf16_stack_overflow.mp4, invoking the dump_ttxt_sample function in src/isomedia/box_dump.c.
4. Stack overflow occurs: The unchecked memcpy writes 30,000 bytes into the 20,000-byte stack buffer utf16Line, corrupting the stack and causing a crash (DoS). Depending on build mitigations, further memory corruption exploitation may be theoretically possible (PoC Report).

• File System: Presence of crafted MP4 files with unusually large tx3g timed-text sample length fields (>20,000 bytes) in media processing directories; unexpected core dump files or crash reports from GPAC/MP4Box processes.
• Logs: Application crash logs or AddressSanitizer output referencing dump_ttxt_sample in isomedia/box_dump.c:3605; unexpected termination of MP4Box or GPAC-based services.
• Process: Abnormal termination (segmentation fault, abort signal) of MP4Box or GPAC-related processes immediately after processing an MP4 file with timed-text tracks (PoC Report).

No official patch from the GPAC project has been confirmed as of the time of publication. Users should upgrade GPAC to a version newer than 2.4.0 once a patched release becomes available, and monitor the GPAC GitHub repository for security fixes. As an interim measure, avoid processing untrusted MP4 files with GPAC tools, implement network-level controls to restrict access to GPAC-based services, and consider disabling timed-text export functionality (-ttxt) if not operationally required. The suggested code fix is to validate the copy length before the memcpy call: copy_len = min(s_txt->len - 2, sizeof(utf16Line) - 2) and reject inputs with unreasonably large lengths (PoC Report, Red Hat Advisory).

Red Hat published a security advisory tracking this CVE, indicating awareness among enterprise Linux vendors. Brief social media mentions were observed on Mastodon via @thehackerwire shortly after disclosure. No significant vendor statements, researcher commentary, or major media coverage beyond standard vulnerability aggregator listings have been identified (Red Hat Advisory).