CVE-2025-70307

A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.

An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.

A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.

GPAC v2.4.0 was found to contain an out-of-bounds read in the oggdmx_parse_tags function. The issue occurs during processing of OGG data.

Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function.

A NULL pointer dereference vulnerability exists in the smooth_parse_stream_index() function in src/media_tools/mpd.c of GPAC. The issue is fixed in commit b35c61f104b85fbb16520ac2838d5d2ef70845b5.

A vulnerability was found in GPAC up to b40ce70f5 in the function sgpd_del_entry of the file src/isomedia/box_code_base.c of the MP4Box component. Manipulation of the data argument leads to a heap-based buffer overflow. Local access is required and the exploit is publicly available.

A vulnerability was found in GPAC up to version 2.5-DEV in the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c in the MP4Box component. Manipulation of the nalu_out_bs argument causes a double free. The attack can be performed locally and the exploit has been publicly disclosed.

A security vulnerability was detected in GPAC 26.03-DEV-rev342-g80071f700-master in the function txtin_probe_duration of the file src/filters/load_text.c of the TeXML File Handler component. Manipulation of the argument txml_timescale leads to a divide by zero. The attack requires local access.

A flaw in GPAC 26.02.0 affects the nhmldump_send_frame function in src/filters/write_nhml.c of the Media File Handler component, leading to a null pointer dereference. The attack requires local access and an exploit has been published.