{"id":"CVE-2025-71468","kind":"vulnerability","aliases":["CVE-2025-71468"],"related":[],"title":"GPAC: crafted DASH manifest crashes MP4Box and GPAC DASH clients","description":"GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in src/media_tools/dash_client.c that allows attackers to crash applications via crafted DASH manifests. Attackers can supply an MPD whose AudioChannelConfiguration element omits schemeIdUri or value, crashing MP4Box or GPAC DASH clients and causing denial of service.","summary":"GPAC before 26.02.0 has a NULL pointer dereference in the DASH client code that reads audio channel settings. A crafted MPD manifest whose AudioChannelConfiguration element omits schemeIdUri or value crashes MP4Box or GPAC DASH clients, causing denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dash-streaming","gpac","media-processing","mp4box","package"],"not_affected_if":["gpac-26.02.0-or-later","trusted-input-only"],"how_to_check":"- Check the installed GPAC version with `MP4Box -version` and confirm whether it is below `26.02.0`.\n- Look for any service or workflow that feeds untrusted DASH MPD manifests into MP4Box or GPAC DASH clients.","fix":"- GPAC: move to `26.02.0` or later.","status":"open","published_at":"2026-11-15T16:16:55+00:00","first_seen_at":"2026-11-15T16:35:37+00:00","triaged_at":"2026-11-15T16:37:16+00:00","updated_at":"2026-11-15T16:37:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-15T16:37:16Z","model":"claude-haiku-5-5","output":{"fix":"- GPAC: move to `26.02.0` or later.","reach":"network","title":"GPAC: crafted DASH manifest crashes MP4Box and GPAC DASH clients","impact":"low","summary":"GPAC before 26.02.0 has a NULL pointer dereference in the DASH client code that reads audio channel settings. A crafted MPD manifest whose AudioChannelConfiguration element omits schemeIdUri or value crashes MP4Box or GPAC DASH clients, causing denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["gpac","mp4box","dash-streaming","media-processing"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Application crashes, causing denial of service for the process.","analyst_note":"","how_to_check":"- Check the installed GPAC version with `MP4Box -version` and confirm whether it is below `26.02.0`.\n- Look for any service or workflow that feeds untrusted DASH MPD manifests into MP4Box or GPAC DASH clients.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-input-only","gpac-26.02.0-or-later"],"who_is_affected":"Teams that run GPAC's MP4Box tool or DASH client on manifests from outside sources are exposed, since the crash is triggered by the content of the MPD file. Systems that only process trusted, locally built media can skip it. The sources do not describe a data-theft path, only a crash.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000754,"input_tokens":4643,"output_tokens":580,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':12A,15A '-71468':13A,16A '26.02.0':28B,67C 'allow':84C 'applic':88C 'attack':85C,93C 'audio':41B,79C 'audiochannelconfigur':49B,99C 'caus':61B,112C 'channel':42B,80C 'client':10A,37B,60B,110C 'code':38B 'contain':68C 'craft':2A,45B,90C 'crash':5A,55B,87C,105C 'cve':11A,14A 'dash':3A,9A,18B,36B,59B,76C,91C,109C 'dash-stream':17B 'denial':62B,113C 'derefer':33B,72C 'element':50B,100C 'get':78C 'gf':75C 'gpac':1A,8A,20B,26B,58B,65C,108C 'group':77C 'manifest':4A,47B,92C 'media':22B 'media-process':21B 'mp4box':6A,24B,56B,106C 'mpd':46B,97C 'null':31B,70C 'omit':51B,101C 'packag':25B 'pointer':32B,71C 'process':23B 'read':40B 'schemeiduri':52B,102C 'servic':64B,115C 'set':43B 'src/media_tools/dash_client.c':82C 'stream':19B 'suppli':95C 'valu':54B,104C 'via':89C 'vulner':73C 'whose':48B,98C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC's MP4Box tool or DASH client on manifests from outside sources are exposed, since the crash is triggered by the content of the MPD file. Systems that only process trusted, locally built media can skip it. The sources do not describe a data-theft path, only a crash.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dashstreaming","gpac","mediaprocessing","medium","mp4box","package"],"campaign_type":null,"search_a":"'-2025':12A,15A '-71468':13A,16A 'client':10A 'craft':2A 'crash':5A 'cve':11A,14A 'dash':3A,9A 'gpac':1A,8A 'manifest':4A 'mp4box':6A","search_b":"'26.02.0':28B 'audio':41B 'audiochannelconfigur':49B 'caus':61B 'channel':42B 'client':37B,60B 'code':38B 'craft':45B 'crash':55B 'dash':18B,36B,59B 'dash-stream':17B 'denial':62B 'derefer':33B 'element':50B 'gpac':20B,26B,58B 'manifest':47B 'media':22B 'media-process':21B 'mp4box':24B,56B 'mpd':46B 'null':31B 'omit':51B 'packag':25B 'pointer':32B 'process':23B 'read':40B 'schemeiduri':52B 'servic':64B 'set':43B 'stream':19B 'valu':54B 'whose':48B","search_c":"'26.02.0':67C 'allow':84C 'applic':88C 'attack':85C,93C 'audio':79C 'audiochannelconfigur':99C 'caus':112C 'channel':80C 'client':110C 'contain':68C 'craft':90C 'crash':87C,105C 'dash':76C,91C,109C 'denial':113C 'derefer':72C 'element':100C 'get':78C 'gf':75C 'gpac':65C,108C 'group':77C 'manifest':92C 'mp4box':106C 'mpd':97C 'null':70C 'omit':101C 'pointer':71C 'schemeiduri':102C 'servic':115C 'src/media_tools/dash_client.c':82C 'suppli':95C 'valu':104C 'via':89C 'vulner':73C 'whose':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T16:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71468","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71468","severity":null,"published_at":"2026-11-15T16:16:55+00:00","modified_at":"2026-11-15T16:16:55+00:00","first_seen_at":"2026-11-15T16:35:37+00:00","fetched_at":"2026-11-15T16:35:37+00:00","note":null}],"documents":[{"id":164378,"url":"https://github.com/gpac/gpac/commit/62714f27c64a3d1eb7e880f9eed2d38673cb43ce","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":164383,"url":"https://www.vulncheck.com/advisories/gpac-before-26.02.0-null-pointer-dereference-via-gf-dash-group-get-audio-channels","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}