Live › vulnerability › CVE-2025-71438
Go to dashboardGPAC's MP4Box tool reads past the end of a buffer while parsing AC4 audio configuration data in its descriptor code. An attacker who supplies a crafted AC4 file can crash the process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC MP4Box versions before v26.07.0 on files they did not create, such as user uploads or media ingest pipelines. Systems that only process their own trusted media, or do not use MP4Box, can skip it.
No product ranges from the sources yet.
MP4Box -version and compare against v26.07.0v26.07.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-71438")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.