CVE-2025-70310: 
NixOS vulnerability analysis and mitigation

CVE-2025-70310 is a heap-based buffer overflow vulnerability in the vorbis_to_intern() function of GPAC v2.4.0, a widely used open-source multimedia framework. The flaw allows attackers to cause a Denial of Service (DoS) — and potentially memory corruption — by supplying a crafted .ogg file containing a 6-channel (5.1) Vorbis stream. It was published on January 15, 2026, with initial analysis completed by January 23, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), assessed by CISA-ADP (Red Hat CVE, GitHub PoC).

The root cause is an off-by-one error in the 6-channel remapping logic within vorbis_to_intern() in src/filters/dec_vorbis.c (CWE-122: Heap-based Buffer Overflow). When decoding a 6-channel Vorbis stream, the code sets ptr = &data[i+1] for channel index i==5, yielding ptr = &data[6] — one element past the valid range of data[0..5] for the first PCM frame. The loop then writes 2-byte PCM samples at this out-of-bounds address for every sample in the stream, resulting in deterministic heap memory corruption. Exploitation requires a victim to open or process a crafted .ogg file using GPAC or a GPAC-based application; a public PoC generator (gen_poc_vorbis.py) and reproduction steps using AddressSanitizer are available (GitHub PoC).

The confirmed impact is a Denial of Service via application crash when GPAC processes a malicious .ogg file. Because the vulnerability is a heap out-of-bounds write (memory corruption), the PoC author notes that exploitation beyond DoS — such as arbitrary code execution — may be possible depending on build configuration and runtime environment, though this has not been demonstrated. There is no confidentiality or integrity impact confirmed at this time; the primary risk is availability loss for any user or automated pipeline processing untrusted .ogg files with GPAC 2.4.0 (GitHub PoC, Red Hat CVE).

A public proof-of-concept exploit is available on GitHub, including a Python script (gen_poc_vorbis.py) that generates a malicious .ogg file to trigger the overflow (GitHub PoC). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. Exploitation requires user interaction — the victim must open a crafted .ogg file — limiting the attack surface to local or socially engineered delivery vectors (Red Hat CVE).

1. Craft malicious file: Use the public PoC generator (gen_poc_vorbis.py) to produce a crafted 6-channel Vorbis .ogg file (poc_vorbis_6ch_heap_oobwrite.ogg) that triggers the off-by-one channel remapping bug in vorbis_to_intern().
2. Deliver the file: Send the malicious .ogg file to the target via email attachment, file-sharing platform, or other local delivery mechanism, relying on social engineering to prompt the victim to open it.
3. Trigger processing: The victim opens the file with GPAC v2.4.0 or a GPAC-based application (e.g., gpac -i poc_vorbis_6ch_heap_oobwrite.ogg oggdmx vorbisdec -o null), initiating Vorbis stream decoding.
4. Heap overflow triggered: During decoding of the 6-channel stream, vorbis_to_intern() sets ptr = &data[6] for channel index 5, writing PCM samples out-of-bounds on the heap for every sample in the stream.
5. Achieve DoS: The out-of-bounds heap write causes a crash (DoS), terminating the GPAC process. Under certain build/runtime conditions, further memory corruption effects may be possible (GitHub PoC).

• File System: Presence of unexpected .ogg files with 6-channel (5.1) Vorbis streams in user download, temp, or media directories; files named poc_vorbis_6ch_heap_oobwrite.ogg or similar.
• Process: Abnormal termination (crash) of the gpac process or GPAC-based applications immediately after opening an .ogg file; core dump files generated by the GPAC process.
• Logs: Application crash logs or AddressSanitizer output referencing heap-buffer-overflow in vorbis_to_intern within dec_vorbis.c; OS-level crash reports (e.g., Windows Event Log application errors, Linux dmesg segfault entries) tied to GPAC.
• Network: Delivery of .ogg files via email or file-sharing platforms from unknown or untrusted senders, particularly files with unusually small size but claiming multi-channel audio (GitHub PoC).

No official patch from the GPAC project has been confirmed as of the time of publication; users should monitor the GPAC project repository for security updates (Red Hat CVE). In the interim, restrict processing of .ogg files from untrusted sources, implement file sandboxing or content inspection before GPAC processes media files, and consider blocking or quarantining multi-channel .ogg files in email and file-sharing systems. Users should avoid opening .ogg files from unknown sources with GPAC 2.4.0, and evaluate alternative media processing tools where feasible until a patched version is released.

Red Hat has acknowledged the vulnerability and published a CVE tracking page, though no Red Hat-specific patch or product impact statement has been issued (Red Hat CVE). A technical write-up was published at infinitsec.net shortly after disclosure, providing additional context on the vulnerability (infinitsec.net). Broader community and social media reactions are limited, consistent with the Medium severity rating and lack of active exploitation.