CVE-2025-70309: 
NixOS vulnerability analysis and mitigation

CVE-2025-70309 is a stack-based buffer overflow vulnerability in the pcmreframe_flush_packet function of GPAC v2.4.0 that allows attackers to cause a Denial of Service (DoS) via a crafted WAV file. The vulnerability was received by MITRE and published on January 15, 2026, with initial NVD analysis completed on January 23, 2026. Only GPAC version 2.4.0 is confirmed affected, though other versions containing the same reverse-playback logic may also be vulnerable. It carries a CVSS v3.1 base score of 5.5 (Medium), assessed by CISA-ADP (Red Hat CVE, PoC Report).

The root cause is a stack-based buffer overflow (CWE-121) in src/filters/reframe_rawpcm.c within the pcmreframe_flush_packet function. During reverse playback, the function uses a fixed-size stack buffer char store[100]; as a swap temporary when reversing PCM samples in-place, but copies nb_bytes_in_sample = ctx->Bps * ctx->ch bytes into it without bounds checking. Because the channel count (ctx->ch) and bytes-per-sample (ctx->Bps) are derived directly from the WAV file header, an attacker can craft a WAV with, for example, 64 channels at 16 bits per sample, yielding nb_bytes_in_sample = 128, which overflows the 100-byte buffer. Reverse playback is triggered when the playback speed is set to a negative value (e.g., gpac -speed=-1), meaning the victim must open the file in a context where reverse playback is enabled (PoC Report).

Successful exploitation results in a crash of the GPAC application (Denial of Service) at minimum, with no impact on confidentiality or integrity. Because the vulnerability is a stack out-of-bounds write (memory corruption), the potential for further exploitation — such as arbitrary code execution — exists depending on build flags, compiler mitigations, and stack layout, though this has not been demonstrated publicly. The attack is local and requires user interaction (a victim must open a crafted WAV file), limiting the blast radius to the affected user's session and any GPAC-based media processing pipelines (PoC Report, Red Hat CVE).

A public proof-of-concept exploit is available on GitHub, including a Python script (poc_rfpcm_reverse_stack_overflow.py) that generates a malicious WAV file to trigger the overflow (PoC Report). The exploit was added to NVD references on January 23, 2026. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), reflecting a very low probability of exploitation in the near term. Detection is available via Nessus plugin ID 287962.

1. Craft a malicious WAV file: Use the public PoC Python script (poc_rfpcm_reverse_stack_overflow.py) to generate a WAV file with a crafted header specifying a large channel count (e.g., channels=64, bits_per_sample=16), resulting in bytes_per_sample = 128 > 100.
2. Deliver the file to the victim: Social-engineer the target into opening the crafted WAV file using a GPAC-based application, or place it in a location where GPAC is configured to process media files automatically.
3. Trigger reverse playback: Ensure the GPAC application processes the file with negative playback speed, either by invoking gpac -speed=-1 -i poc_rfpcm_reverse_stack_overflow.wav:rfpcm -o null directly or by exploiting an application that enables reverse playback.
4. Overflow the stack buffer: When pcmreframe_flush_packet processes the crafted WAV during reverse playback, it copies 128 bytes into the 100-byte store buffer, causing a stack overflow and crashing the application (DoS). Under certain build configurations without stack protections, further memory corruption may be achievable (PoC Report).

• File System: Presence of files named poc_rfpcm_reverse_stack_overflow.wav or WAV files with unusually high channel counts (e.g., 64+ channels) in user download or temp directories.
• Process: Unexpected crash or abnormal termination of GPAC or GPAC-based media player processes; core dump files generated by the GPAC process.
• Logs: Application crash logs or OS-level crash reports referencing pcmreframe_flush_packet or reframe_rawpcm.c; AddressSanitizer (ASan) output indicating stack buffer overflow in GPAC if built with sanitizers enabled.
• Network: Delivery of crafted WAV files via email attachments, web downloads, or file shares from untrusted sources to systems running GPAC.

No official patch from the GPAC project has been confirmed in the available data. The suggested code fix is to replace the fixed-size char store[100]; buffer in pcmreframe_flush_packet with a dynamically sized buffer, or to add a bounds check (nb_bytes_in_sample <= sizeof(store)) before the memcpy. As interim mitigations: restrict users from opening WAV files from untrusted sources; disable or avoid reverse playback functionality (-speed with negative values) if not required; and monitor for exploitation attempts using Nessus detection ID 287962. Organizations should track the GPAC project for an official patched release and upgrade when available (PoC Report, Red Hat CVE).

Red Hat has acknowledged the vulnerability and published a CVE entry, though no Red Hat products are listed as affected at this time (Red Hat CVE). INCIBE-CERT (Spain's national cybersecurity agency) has also published an early warning for the vulnerability. No significant broader media coverage or notable researcher commentary beyond the original PoC disclosure has been identified.