CVE-2025-70309
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-15

Last updated on: 2026-01-15

Assigner: MITRE

Description
A stack overflow in the pcmreframe_flush_packet function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted WAV file.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-15
Last Modified
2026-01-15
Generated
2026-06-16
AI Q&A
2026-01-16
EPSS Evaluated
2026-06-15
NVD
CVE-2025-70309
EUVD
EUVD-2026-2739
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
gpac gpac 2.4.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a stack overflow in the pcmreframe_flush_packet function of GPAC version 2.4.0. It can be triggered by an attacker using a specially crafted WAV file, which causes the program to crash or behave unexpectedly.

Impact Analysis

The vulnerability can lead to a Denial of Service (DoS) condition, meaning that an attacker can cause the affected application to crash or become unavailable by providing a malicious WAV file.

Detection Guidance

This vulnerability can be detected by analyzing WAV files processed by GPAC v2.4.0 for signs of crafted packets that trigger the stack overflow in the pcmreframe_flush_packet function. A proof-of-concept (PoC) is available which can be used to test if the system is vulnerable. Specific commands are not detailed, but using the PoC from the linked GitHub resource to test WAV files or the GPAC processing behavior can help detect the vulnerability. [1]

Mitigation Strategies

Immediate mitigation steps include avoiding the use of untrusted or suspicious WAV files with GPAC v2.4.0, especially those obtained from unverified sources. Applying any available patches or updates from the GPAC project that address this vulnerability is recommended. If no patch is available, consider disabling or restricting the use of the vulnerable function or component until a fix is applied. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-70309. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart