CVE-2025-70308: 
NixOS vulnerability analysis and mitigation

CVE-2025-70308 is a heap out-of-bounds read vulnerability in the GSF demuxer filter (gsfdmx) component of GPAC v2.4.0 that allows unauthenticated remote attackers to cause a Denial of Service (DoS) via a specially crafted .gsf file. The vulnerability was published on January 15, 2026, with initial analysis completed by January 23, 2026. It affects GPAC version 2.4.0, with other versions containing the same gsfdmx magic parsing/logging logic potentially also affected. The CVSS v3.1 base score is 7.5 (High), assigned by CISA-ADP (Red Hat CVE, PoC Report).

The root cause (CWE-125: Out-of-bounds Read) lies in the gsfdmx_tune() function within src/filters/dmx_gsf.c. When parsing a tune-in header, the code allocates exactly len bytes for a magic buffer and reads len bytes into it without appending a NUL terminator; subsequently, the buffer is passed to a GF_LOG call using a %s format specifier, causing the printf-style formatter to read past the heap allocation until a NUL byte is encountered. A secondary OOB read risk exists in a memcmp(ctx->magic, magic, len) call where an attacker-controlled len value may exceed the length of ctx->magic. Exploitation requires a victim to open or process a crafted .gsf file through a GPAC filter graph that instantiates the gsfdmx filter (PoC Report).

Successful exploitation causes a Denial of Service through application crash, particularly in AddressSanitizer (ASan) builds where the heap OOB read is reliably detected. Additionally, there is a potential for limited information disclosure: out-of-bounds heap bytes may be read and printed as part of the logged "magic" string until a NUL byte is encountered, depending on allocator behavior and log output availability. Because this is an OOB read rather than a write, direct memory corruption or code execution is not a demonstrated risk, but service availability is the primary concern for any system processing untrusted .gsf files (PoC Report, Red Hat CVE).

A public proof-of-concept (PoC) is available on GitHub, including a Python script (gen_poc_gsf_magic_oobread.py) that generates a crafted .gsf file to trigger the vulnerability. The EPSS score is approximately 0.04%, indicating a low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (PoC Report, Red Hat CVE).

1. Craft a malicious .gsf file: Use the public PoC generator script (gen_poc_gsf_magic_oobread.py) to create a .gsf file containing a tune-in header with a magic field of length len > 0 (e.g., magic_len=4, magic_bytes="ABCD") and no NUL terminator.
2. Deliver the file to the target: Provide the crafted .gsf file to a system running GPAC v2.4.0, either by hosting it on a network-accessible location or delivering it directly to a user or automated pipeline that processes .gsf files.
3. Trigger processing via GPAC: The victim (or automated system) opens the file using a GPAC filter graph that instantiates the gsfdmx filter, e.g., gpac -i poc_gsf_magic_oobread.gsf:gsfdmx:magic=ABCD inspect:deep.
4. Trigger OOB read: The gsfdmx_tune() function allocates len bytes for the magic buffer without NUL-terminating it, then passes it to GF_LOG with %s, causing the formatter to read past the heap allocation.
5. Achieve DoS: The application crashes (especially in ASan builds) or reads and logs out-of-bounds heap bytes, resulting in service unavailability (PoC Report).

• File System: Presence of crafted .gsf files with unusual or non-standard tune-in header magic fields; presence of gen_poc_gsf_magic_oobread.py or similar PoC scripts on the system.
• Logs: GPAC application logs (GF_LOG_CONTAINER) showing garbled or unexpected characters in [GSFDemux] tuning in stream, magic ... log entries, which may indicate out-of-bounds bytes being printed.
• Process: Unexpected crashes or core dumps of the gpac process, particularly when processing .gsf files from untrusted sources; AddressSanitizer (ASan) heap-buffer-overflow reports in GPAC process output.
• Network: Unusual inbound delivery of .gsf files from unknown or untrusted sources to systems running GPAC (PoC Report).

No official patch version has been specified in available information as of this report. Organizations should restrict network access to systems running GPAC v2.4.0, particularly those processing untrusted .gsf files. As a workaround, avoid processing .gsf files from untrusted sources, and monitor systems for unexpected crashes or service interruptions that may indicate exploitation attempts. Users should check the GPAC project for updated releases that address this issue and upgrade as soon as a patched version becomes available (Red Hat CVE, PoC Report).

The vulnerability received brief coverage on security-focused social media, including posts on Infosec.Exchange by TheHackerWire and a mention on Bluesky. Red Hat published a CVE advisory page for the issue. A technical write-up was published on infinitsec.net covering the vulnerability details. Overall community reaction has been limited, consistent with the low EPSS score and absence of active exploitation (Red Hat CVE).