CVE-2025-71438: Gpac Project MP4Box vulnerability

Q: Which deployments are exposed?

GPAC Project MP4Box versions before v26.07.0 are affected when they process an attacker-supplied or otherwise crafted AC4 file.

Q: What does an attacker need to exploit this issue?

The attacker needs to supply a crafted AC4 file for MP4Box to process. The stated impact is denial of service through an out-of-bounds read.

Q: Is there an indication that default configurations are affected?

The available information does not identify any configuration prerequisite. It describes the vulnerable condition as occurring during processing of a crafted AC4 file.

Published Oct 21, 2026

Updated

An out-of-bounds read in gfodfac4cfgdsiv1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

Affected Software

1 affected component

Gpac Project MP4Box<26.07.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments are exposed?

GPAC Project MP4Box versions before v26.07.0 are affected when they process an attacker-supplied or otherwise crafted AC4 file.

What does an attacker need to exploit this issue?

The attacker needs to supply a crafted AC4 file for MP4Box to process. The stated impact is denial of service through an out-of-bounds read.

Is there an indication that default configurations are affected?

The available information does not identify any configuration prerequisite. It describes the vulnerable condition as occurring during processing of a crafted AC4 file.

CVE-2025-71438: Gpac Project MP4Box vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Is there an indication that default configurations are affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Is there an indication that default configurations are affected?