CVE-2025-70298

GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function

High · published January 15, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

⚡ An out-of-bounds read in GPAC v2.4.0 could let attackers peek into data they shouldn't be able to access — like a nosy neighbor eavesdropping on your private conversations! 🔍 Think of it as a restaurant where the chef accidentally leaves a door open — anyone can sneak a glance at the secret recipes inside! This vulnerability lets unauthorized access to memory, potentially exposing sensitive information. If exploited, an attacker could read sensitive data from memory, leading to information leaks that could compromise user privacy and system integrity. This might not be the most catastrophic breach, but it could certainly cause significant headaches!

Put simply

Think of it as a restaurant where the chef accidentally leaves a door open — anyone can sneak a glance at the secret recipes inside! This vulnerability lets unauthorized access to memory, potentially exposing sensitive information. The out-of-bounds read in the oggdmx_parse_tags function of GPAC allows attackers to read beyond allocated memory limits, potentially accessing confidential information or crashing the application.

What to do

If exploited, an attacker could read sensitive data from memory, leading to information leaks that could compromise user privacy and system integrity. This might not be the most catastrophic breach, but it could certainly cause significant headaches! Update GPAC to version 2.4.1 or later immediately to patch this vulnerability. Ensure your application includes robust memory bounds checking and regularly audit code for similar vulnerabilities. You've got this! With a quick update, your system will be back to superhero status in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Published
2026-01-15T00:00Z
EPSS history
Timeline
  • 15 JAN 00:00Z
    GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function
    cvelistv5