CVE-2025-25723
Published: 28 February 2025
Description
Adversaries may exploit software vulnerabilities in client applications to execute code.
Security Summary
CVE-2025-25723 is a buffer overflow vulnerability (CWE-120) in GPAC version 2.5. This flaw enables a local attacker to execute arbitrary code on affected systems running the vulnerable version of the GPAC multimedia framework.
The vulnerability can be exploited by a local attacker requiring only local access (AV:L), low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), with an unchanged scope (S:U). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS 3.1 base score of 8.4.
Mitigation is available through a patch in the GPAC GitHub repository at commit 74e26b8dfeb0ab8c7317603b80a18306d0698473. Additional details on the issue are documented in GPAC GitHub issue #3089.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Buffer overflow in GPAC (client multimedia framework) enables local arbitrary code execution with no privileges required, directly mapping to Exploitation for Client Execution.