CVE-2025-70305 – A stack overflow vulnerability in GPAC's dmx

Q: What is the severity of CVE-2025-70305?

CVE-2025-70305 has a CVSS score of 5.5 (MEDIUM). A stack overflow vulnerability in GPAC's dmx_saf function allows attackers to cause Denial of Service (DoS) by providing a specially crafted .saf file. This affects systems running GPAC v2.4.0 that process .saf files, potentially crashing the application or service.

📋 TL;DR

A stack overflow vulnerability in GPAC's dmx_saf function allows attackers to cause Denial of Service (DoS) by providing a specially crafted .saf file. This affects systems running GPAC v2.4.0 that process .saf files, potentially crashing the application or service.

💻 Affected Systems

Products:

GPAC (Multimedia Framework)

Versions: v2.4.0

Operating Systems: All platforms running GPAC

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability triggers when processing .saf files; systems not handling .saf files are not affected.

📦 What is this software?

Gpac by Gpac

View all CVEs affecting Gpac →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service disruption through application crash, potentially affecting dependent systems or workflows.

🟠

Likely Case

Application crash when processing malicious .saf files, requiring restart and causing temporary service interruption.

🟢

If Mitigated

Controlled crash with minimal impact if proper monitoring and restart mechanisms are in place.

🌐 Internet-Facing: MEDIUM - Requires file upload/processing capability; risk depends on exposure of .saf file handling functionality.

🏢 Internal Only: LOW - Requires attacker to supply malicious .saf file to vulnerable system; limited to internal threat actors.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Proof of concept available in GitHub repository; exploitation requires delivering crafted .saf file to vulnerable system.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Not available

Vendor Advisory: Not available

Restart Required: No

Instructions:

No official patch available. Monitor GPAC releases for security updates addressing CVE-2025-70305.

🔧 Temporary Workarounds

Disable .saf file processing

all

Configure GPAC to reject or not process .saf files if not required for functionality.

Input validation for .saf files

all

Implement file validation/sanitization before processing .saf files.

🧯 If You Can't Patch

Implement network segmentation to isolate GPAC systems from untrusted networks.
Deploy application monitoring to detect crash events and trigger automated recovery.

🔍 How to Verify

Check if Vulnerable:

Check GPAC version: if running v2.4.0 and processes .saf files, system is vulnerable.

Check Version:

gpac --version

Verify Fix Applied:

When patch becomes available, verify version is updated beyond v2.4.0 and test with safe .saf files.

📡 Detection & Monitoring

Log Indicators:

GPAC crash logs
Segmentation fault errors
Abnormal termination of gpac processes

Network Indicators:

Unexpected .saf file transfers to GPAC systems

SIEM Query:

source="gpac.log" AND ("segmentation fault" OR "crash" OR "abnormal termination")

📊 Metadata

CVE ID: CVE-2025-70305

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE: CWE-121

EPSS Score: 0.02% exploit probability (3.9th percentile)

Published: January 15, 2026

Last Updated: January 23, 2026

🔗 References

https://github.com/zakkanijia/POC/blob/main/gpac_saf/GPAC_SAF.md Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-70305, you might also want to check these: