CVE-2025-70308

An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file

High ยท published January 15, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

โšก An out-of-bounds read in GPAC's GSF demuxer filter is an unexpected invite for chaos! With just a mischievously crafted .gsf file, attackers can cause a Denial of Service. ๐Ÿ›‘ Think of this vulnerability like a movie theater showing a film with a surprise twist that completely derails the entire schedule โ€” one rogue screening can throw everything into turmoil! ๐ŸŽฌ This means that an attacker could deliver a specially designed file that crashes the system, leaving users locked out and unable to access their media. In the worst-case scenario, it could result in significant downtime and disruption! ๐Ÿ”ฅ

Put simply

Think of this vulnerability like a movie theater showing a film with a surprise twist that completely derails the entire schedule โ€” one rogue screening can throw everything into turmoil! ๐ŸŽฌ The out-of-bounds read allows attackers to manipulate memory access in GPAC v2.4.0 when handling certain .gsf files, leading to potential crashes and service outages.

What to do

This means that an attacker could deliver a specially designed file that crashes the system, leaving users locked out and unable to access their media. In the worst-case scenario, it could result in significant downtime and disruption! ๐Ÿ”ฅ To protect against this vulnerability, immediately update GPAC to version 2.4.1, which contains the necessary fixes. Additionally, review your file handling procedures to prevent untrusted files from being processed. ๐Ÿ›ก๏ธ You've got this! Take these steps and secure your systems from unexpected disruptions! ๐Ÿš€

The record
Technical detail
CVSS v3.1
7.5 ยท HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00376 ยท 30.3th percentile
Published
2026-01-15T00:00Z
EPSS history
Timeline
  • 15 JAN 00:00Z
    An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file
    cvelistv5