CVE-2025-71438: Out-of-bounds ad in GPAC/MP4Box via gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stam with invalid frame rate index
Published Oct 21, 2026
·Updated
An out-of-bounds read in gfodfac4cfgdsiv1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Affected Software
8 affected components
Gpac MP4Box<26.07.0
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
debian/gpac
Event History
Oct 21, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·02:17 PM
Affected Software
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
GPAC Project MP4Box versions before v26.07.0 are affected when they process an attacker-supplied or otherwise crafted AC4 file.
2
What does an attacker need to exploit this issue?
The attacker needs to supply a crafted AC4 file for MP4Box to process. The stated impact is denial of service through an out-of-bounds read.
3
Is there an indication that default configurations are affected?
The available information does not identify any configuration prerequisite. It describes the vulnerable condition as occurring during processing of a crafted AC4 file.