{"id":"CVE-2025-71438","kind":"vulnerability","aliases":["CVE-2025-71438"],"related":[],"title":"GPAC MP4Box: crafted AC4 file triggers out-of-bounds read, crashing the tool","description":"An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","summary":"GPAC's MP4Box tool reads past the end of a buffer while parsing AC4 audio configuration data in its descriptor code. An attacker who supplies a crafted AC4 file can crash the process, causing denial of service.","severity":"low","cvss":null,"epss":0.00164,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package"],"not_affected_if":["mp4box-not-used","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare against `v26.07.0`\n- Check whether MP4Box is used to process untrusted AC4 or MP4 files, for example in an upload or transcoding pipeline","fix":"- Upgrade GPAC to `v26.07.0` or later","status":"open","published_at":"2026-10-21T14:17:07+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:13+00:00","updated_at":"2026-10-25T05:02:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:02:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC to `v26.07.0` or later","reach":"unknown","title":"GPAC MP4Box: crafted AC4 file triggers out-of-bounds read, crashing the tool","impact":"low","summary":"GPAC's MP4Box tool reads past the end of a buffer while parsing AC4 audio configuration data in its descriptor code. An attacker who supplies a crafted AC4 file can crash the process, causing denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"MP4Box process crashes; denial of service only","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against `v26.07.0`\n- Check whether MP4Box is used to process untrusted AC4 or MP4 files, for example in an upload or transcoding pipeline","needs_analyst":false,"not_affected_if":["trusted-input-only","mp4box-not-used"],"who_is_affected":"Teams that run GPAC MP4Box versions before v26.07.0 on files they did not create, such as user uploads or media ingest pipelines. Systems that only process their own trusted media, or do not use MP4Box, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000579,"input_tokens":3377,"output_tokens":483,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':16A,19A '-71438':17A,20A '/odf/descriptors.c':77C 'ac4':4A,40B,54B,73C,96C 'allow':83C 'attack':49B,84C 'audio':41B 'bound':10A,68C 'buffer':37B 'caus':60B,86C 'cfg':74C 'code':47B 'configur':42B 'craft':3A,53B,95C 'crash':12A,57B 'cve':15A,18A 'data':43B 'denial':61B,88C 'descriptor':46B 'dos':91C 'dsi':75C 'end':34B 'file':5A,55B,97C 'gf':71C 'gpac':1A,21B,27B,79C 'media':23B 'media-process':22B 'mp4box':2A,25B,29B 'odf':72C 'out-of-bound':7A,65C 'packag':26B 'pars':39B 'past':32B 'process':24B,59B 'project/mp4box':80C 'read':11A,31B,69C 'servic':63B,90C 'suppli':51B,93C 'tool':14A,30B 'trigger':6A 'v1':76C 'v26.07.0':82C 'via':92C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC MP4Box versions before v26.07.0 on files they did not create, such as user uploads or media ingest pipelines. Systems that only process their own trusted media, or do not use MP4Box, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71438","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71438","severity":null,"published_at":"2026-10-21T14:17:07+00:00","modified_at":"2026-10-22T21:17:14+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2025-71438","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-71438","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}