CVE-2025-71466 · Package
NO FIX YET · SEE WHAT TO DO
GPAC before 26.02.0 has a NULL pointer dereference in the MPEG-2 transport stream demuxer's SDT handling. A crafted .ts file with an invalid service descriptor crashes MP4Box, causing denial of service.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Anyone running GPAC or MP4Box before 26.02.0 on untrusted MPEG-2 transport stream files, such as services that transcode or inspect uploaded video. Systems that never open external .ts input are unlikely to be reached. The impact stated is a crash, not code execution.
Not affected if gpac-26.02.0-or-later, no-untrusted-ts-input
Who cares gpac, mp4box, video-processing
MP4Box -version26.02.0 or laterGPAC before 26.02.0 contains a NULL pointer dereference vulnerability in m2tsdmx_update_sdt() in src/filters/dmx_m2ts.c that allows attackers to crash the MPEG-2 TS demuxer. Attackers can supply a crafted .ts file with an invalid service descriptor leaving service or provider names NULL to crash MP4Box and cause denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.