CVE-2025-70309
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gpac | gpac | 2.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stack overflow in the pcmreframe_flush_packet function of GPAC version 2.4.0. It can be triggered by an attacker using a specially crafted WAV file, which causes the program to crash or behave unexpectedly.
How can this vulnerability impact me? :
The vulnerability can lead to a Denial of Service (DoS) condition, meaning that an attacker can cause the affected application to crash or become unavailable by providing a malicious WAV file.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by analyzing WAV files processed by GPAC v2.4.0 for signs of crafted packets that trigger the stack overflow in the pcmreframe_flush_packet function. A proof-of-concept (PoC) is available which can be used to test if the system is vulnerable. Specific commands are not detailed, but using the PoC from the linked GitHub resource to test WAV files or the GPAC processing behavior can help detect the vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of untrusted or suspicious WAV files with GPAC v2.4.0, especially those obtained from unverified sources. Applying any available patches or updates from the GPAC project that address this vulnerability is recommended. If no patch is available, consider disabling or restricting the use of the vulnerable function or component until a fix is applied. [1]