CVE-2025-70304
Published: 15 January 2026
Summary
CVE-2025-70304 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Gpac Gpac. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-70304 is a buffer overflow vulnerability (CWE-121) in the vobsub_get_subpic_duration() function of GPAC version 2.4.0. Published on 2026-01-15, it enables attackers to trigger a Denial of Service (DoS) condition by processing a specially crafted packet in the affected multimedia framework.
The vulnerability carries a CVSS v3.1 base score of 7.5 (High), with attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high availability impact (A:H) but no impacts on confidentiality or integrity (C:N/I:N). Remote attackers can exploit it by sending a malicious packet to any GPAC v2.4.0 instance that processes untrusted input, such as during media file parsing or streaming, resulting in application crashes or service disruption.
A proof-of-concept demonstrating the issue is available at https://github.com/zakkanijia/POC/blob/main/gpac_vobsub/GPAC_vobsub.md. No official advisories or patch details were referenced in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2743
Vulnerability details
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow enables remote DoS via crafted input to crash the GPAC application (matches Endpoint DoS via exploitation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates buffer overflows by requiring validation of untrusted packet inputs before processing in functions like vobsub_get_subpic_duration.
Implements memory protections such as address space layout randomization and stack guards to prevent exploitation of buffer overflows leading to DoS.
Requires timely remediation of known flaws like CVE-2025-70304 through patching GPAC to eliminate the buffer overflow vulnerability.