{"id":"CVE-2025-71469","kind":"vulnerability","aliases":["CVE-2025-71469"],"related":[],"title":"GPAC: crafted XMT file crashes MP4Box and other GPAC tools","description":"GPAC before 26.02.0 contains a type confusion vulnerability in ctxload_process() that passes non-object descriptors to ODS_SetupOD() without checking the descriptor tag. Attackers can supply a crafted XMT file with a URL-bearing descriptor that crashes MP4Box or other GPAC-based applications in gf_scene_ns_connect_object(), causing denial of service.","summary":"GPAC before 26.02.0 has a type confusion flaw in ctxload_process() that accepts a non-object descriptor without checking its tag. A crafted XMT file with a URL-bearing descriptor crashes MP4Box or other GPAC-based applications, causing denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package"],"not_affected_if":["gpac-26.02.0-or-later","no-untrusted-xmt-input"],"how_to_check":"- Check the installed GPAC version with `MP4Box -version` and compare it to `26.02.0`.\n- Find out whether anything processes untrusted XMT files with MP4Box or GPAC.","fix":"- GPAC: upgrade to `26.02.0` or later.","status":"open","published_at":"2026-11-15T16:16:56+00:00","first_seen_at":"2026-11-15T16:35:37+00:00","triaged_at":"2026-11-15T16:37:11+00:00","updated_at":"2026-11-15T16:37:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-15T16:37:11Z","model":"claude-haiku-5-5","output":{"fix":"- GPAC: upgrade to `26.02.0` or later.","reach":"local","title":"GPAC: crafted XMT file crashes MP4Box and other GPAC tools","impact":"low","summary":"GPAC before 26.02.0 has a type confusion flaw in ctxload_process() that accepts a non-object descriptor without checking its tag. A crafted XMT file with a URL-bearing descriptor crashes MP4Box or other GPAC-based applications, causing denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Denial of service: the GPAC process crashes on a crafted file.","analyst_note":"","how_to_check":"- Check the installed GPAC version with `MP4Box -version` and compare it to `26.02.0`.\n- Find out whether anything processes untrusted XMT files with MP4Box or GPAC.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["gpac-26.02.0-or-later","no-untrusted-xmt-input"],"who_is_affected":"Systems that run GPAC (MP4Box or GPAC-based applications) on XMT files from untrusted sources are exposed to a crash. Installs that only handle local, trusted media files are much less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4626,"output_tokens":520,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':12A,15A '-71469':13A,16A '26.02.0':25B,69C 'accept':35B 'applic':62B,113C 'attack':92C 'base':61B,112C 'bear':53B,103C 'caus':63B,120C 'check':42B,88C 'confus':29B,73C 'connect':118C 'contain':70C 'craft':2A,46B,96C 'crash':5A,55B,106C 'ctxload':32B,76C 'cve':11A,14A 'denial':64B,121C 'descriptor':40B,54B,83C,90C,104C 'file':4A,48B,98C 'flaw':30B 'gf':115C 'gpac':1A,9A,17B,23B,60B,67C,111C 'gpac-bas':59B,110C 'media':19B 'media-process':18B 'mp4box':6A,21B,56B,107C 'non':38B,81C 'non-object':37B,80C 'ns':117C 'object':39B,82C,119C 'od':85C 'packag':22B 'pass':79C 'process':20B,33B,77C 'scene':116C 'servic':66B,123C 'setupod':86C 'suppli':94C 'tag':44B,91C 'tool':10A 'type':28B,72C 'url':52B,102C 'url-bear':51B,101C 'vulner':74C 'without':41B,87C 'xmt':3A,47B,97C","nicknames":[],"mitigations":[],"who_affected":"Systems that run GPAC (MP4Box or GPAC-based applications) on XMT files from untrusted sources are exposed to a crash. Installs that only handle local, trusted media files are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gpac","mediaprocessing","medium","mp4box","package"],"campaign_type":null,"search_a":"'-2025':12A,15A '-71469':13A,16A 'craft':2A 'crash':5A 'cve':11A,14A 'file':4A 'gpac':1A,9A 'mp4box':6A 'tool':10A 'xmt':3A","search_b":"'26.02.0':25B 'accept':35B 'applic':62B 'base':61B 'bear':53B 'caus':63B 'check':42B 'confus':29B 'craft':46B 'crash':55B 'ctxload':32B 'denial':64B 'descriptor':40B,54B 'file':48B 'flaw':30B 'gpac':17B,23B,60B 'gpac-bas':59B 'media':19B 'media-process':18B 'mp4box':21B,56B 'non':38B 'non-object':37B 'object':39B 'packag':22B 'process':20B,33B 'servic':66B 'tag':44B 'type':28B 'url':52B 'url-bear':51B 'without':41B 'xmt':47B","search_c":"'26.02.0':69C 'applic':113C 'attack':92C 'base':112C 'bear':103C 'caus':120C 'check':88C 'confus':73C 'connect':118C 'contain':70C 'craft':96C 'crash':106C 'ctxload':76C 'denial':121C 'descriptor':83C,90C,104C 'file':98C 'gf':115C 'gpac':67C,111C 'gpac-bas':110C 'mp4box':107C 'non':81C 'non-object':80C 'ns':117C 'object':82C,119C 'od':85C 'pass':79C 'process':77C 'scene':116C 'servic':123C 'setupod':86C 'suppli':94C 'tag':91C 'type':72C 'url':102C 'url-bear':101C 'vulner':74C 'without':87C 'xmt':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T16:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71469","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71469","severity":null,"published_at":"2026-11-15T16:16:56+00:00","modified_at":"2026-11-15T16:16:56+00:00","first_seen_at":"2026-11-15T16:35:37+00:00","fetched_at":"2026-11-15T16:35:37+00:00","note":null}],"documents":[{"id":164378,"url":"https://github.com/gpac/gpac/commit/62714f27c64a3d1eb7e880f9eed2d38673cb43ce","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":164385,"url":"https://www.vulncheck.com/advisories/gpac-before-26.02.0-type-confusion-dos-via-xmt-bt-scene-loader","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}