CVE-2025-71467 · Package
NO FIX YET · SEE WHAT TO DO
GPAC before 26.02.0 has a NULL pointer dereference in gf_node_get_field_by_name() that a crafted XMT scene can trigger. An attacker who gets a team to load the file crashes MP4Box or the GPAC scene loader, causing denial of service.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run GPAC tools (MP4Box or the scene loader) on XMT scene files from outside sources are exposed to a crash. Systems that only process trusted local media are unlikely to be reached by a crafted file. The sources do not describe code execution, only denial of service.
Not affected if gpac-not-installed, trusted-input-only
Who cares gpac, media-processing, mp4box
MP4Box -version or gpac -version and compare against 26.02.026.02.0 or laterGPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_node_get_field_by_name() in src/scenegraph/base_scenegraph.c that lets attackers crash applications. Attackers can supply a crafted XMT scene referencing a never-created node to crash MP4Box or GPAC scene loader applications, causing denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.