---
id: "CVE-2025-71468"
page: "https://infrastack.ai/live/CVE-2025-71468"
kind: "vulnerability"
aliases: ["CVE-2025-71468"]
title: "GPAC: crafted DASH manifest crashes MP4Box and GPAC DASH clients"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dash-streaming", "gpac", "media-processing", "mp4box", "package"]
not_affected_if: ["gpac-26.02.0-or-later", "trusted-input-only"]
published_at: "2026-11-15T16:16:55+00:00"
first_seen_at: "2026-11-15T16:35:37+00:00"
updated_at: "2026-11-15T16:37:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71468", "first_seen_at": "2026-11-15T16:35:37+00:00"}]
exploit_sources: []
---

# GPAC: crafted DASH manifest crashes MP4Box and GPAC DASH clients

Link for people: https://infrastack.ai/live/CVE-2025-71468 (this .md is for agents)

GPAC before 26.02.0 has a NULL pointer dereference in the DASH client code that reads audio channel settings. A crafted MPD manifest whose AudioChannelConfiguration element omits schemeIdUri or value crashes MP4Box or GPAC DASH clients, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GPAC version with `MP4Box -version` and confirm whether it is below `26.02.0`.
- Look for any service or workflow that feeds untrusted DASH MPD manifests into MP4Box or GPAC DASH clients.

## Fix

- GPAC: move to `26.02.0` or later.

## Timeline

- 2026-11-15T16:35:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-71468

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/gpac-before-26.02.0-null-pointer-dereference-via-gf-dash-group-get-audio-channels
- [fix] Patch: github.com https://github.com/gpac/gpac/commit/62714f27c64a3d1eb7e880f9eed2d38673cb43ce

## From the sources

GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in src/media_tools/dash_client.c that allows attackers to crash applications via crafted DASH manifests. Attackers can supply an MPD whose AudioChannelConfiguration element omits schemeIdUri or value, crashing MP4Box or GPAC DASH clients and causing denial of service.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_