Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-70307: GPAC v2.4.0: Denial of Service via Malformed Packet

CVE-2025-70307 · published 9 months ago

Summary

A bug in GPAC version 2.4.0 can cause the software to crash when it receives a specially crafted packet. This can lead to a denial of service, making it unavailable to users. Update to a fixed version of GPAC to prevent this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
gpac	gpac	2.4.0 `cpe:2.3:a:gpac:gpac:2.4.0:::::::*`

Original advisory text

A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.

References

https://github.com/zakkanijia/POC/blob/main/gpac_boxDump/GPAC_tx3g.md URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70307... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-70307 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-121Stack-based Buffer Overflow

Timeline

Published15 Jan 2026

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-70307 · NVD

CVE-2025-70307 · OSV

Track software like this

Free during beta