CVE-2025-71469 · Package
NO FIX YET · SEE WHAT TO DO
GPAC before 26.02.0 has a type confusion flaw in ctxload_process() that accepts a non-object descriptor without checking its tag. A crafted XMT file with a URL-bearing descriptor crashes MP4Box or other GPAC-based applications, causing denial of service.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems that run GPAC (MP4Box or GPAC-based applications) on XMT files from untrusted sources are exposed to a crash. Installs that only handle local, trusted media files are much less exposed.
Not affected if gpac-26.02.0-or-later, no-untrusted-xmt-input
Who cares gpac, media-processing, mp4box
MP4Box -version and compare it to 26.02.0.26.02.0 or later.GPAC before 26.02.0 contains a type confusion vulnerability in ctxload_process() that passes non-object descriptors to ODS_SetupOD() without checking the descriptor tag. Attackers can supply a crafted XMT file with a URL-bearing descriptor that crashes MP4Box or other GPAC-based applications in gf_scene_ns_connect_object(), causing denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.