CVE-2025-70304
Published: 15 January 2026
Summary
CVE-2025-70304 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Gpac Gpac. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 10.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow enables remote DoS via crafted input to crash the GPAC application (matches Endpoint DoS via exploitation).
NVD Description
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Deeper analysisAI
CVE-2025-70304 is a buffer overflow vulnerability (CWE-121) in the vobsub_get_subpic_duration() function of GPAC version 2.4.0. Published on 2026-01-15, it enables attackers to trigger a Denial of Service (DoS) condition by processing a specially crafted packet in the affected multimedia framework.
The vulnerability carries a CVSS v3.1 base score of 7.5 (High), with attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high availability impact (A:H) but no impacts on confidentiality or integrity (C:N/I:N). Remote attackers can exploit it by sending a malicious packet to any GPAC v2.4.0 instance that processes untrusted input, such as during media file parsing or streaming, resulting in application crashes or service disruption.
A proof-of-concept demonstrating the issue is available at https://github.com/zakkanijia/POC/blob/main/gpac_vobsub/GPAC_vobsub.md. No official advisories or patch details were referenced in the available information.
Details
- CWE(s)