CVE-2025-71468 · Package
NO FIX YET · SEE WHAT TO DO
GPAC before 26.02.0 has a NULL pointer dereference in the DASH client code that reads audio channel settings. A crafted MPD manifest whose AudioChannelConfiguration element omits schemeIdUri or value crashes MP4Box or GPAC DASH clients, causing denial of service.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run GPAC's MP4Box tool or DASH client on manifests from outside sources are exposed, since the crash is triggered by the content of the MPD file. Systems that only process trusted, locally built media can skip it. The sources do not describe a data-theft path, only a crash.
Not affected if gpac-26.02.0-or-later, trusted-input-only
Who cares dash-streaming, gpac, media-processing, mp4box
MP4Box -version and confirm whether it is below 26.02.0.26.02.0 or later.GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in src/media_tools/dash_client.c that allows attackers to crash applications via crafted DASH manifests. Attackers can supply an MPD whose AudioChannelConfiguration element omits schemeIdUri or value, crashing MP4Box or GPAC DASH clients and causing denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.