https://seclists.org/oss-sec/2026/q4/328: CVE-2025-71438: Out-of-bounds ad in GPAC/MP4Box via gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stam with invalid frame rate index

Q: Who is exposed to this issue?

Systems using GPAC/MP4Box to process AC-4 files are exposed when an attacker can cause a crafted file to be provided to the affected processing path. The CVSS vector indicates user interaction is required.

Q: What does an attacker need to exploit it?

An attacker needs only the ability to provide a crafted AC-4 file containing an out-of-range frame rate index. No authentication or special privileges are required.

Q: How can I recognize exploitation or a triggering file?

A triggering file can cause an immediate process termination with a segmentation fault after an invalid frame_rate_index is used to access fixed-size AC-4 lookup tables. The reported crash involved a read at address 0x000000000000.

Published Oct 22, 2026

Updated

Affected Software

1 affected component

Gpac MP4Box<26.07.0

Frequently Asked Questions

Who is exposed to this issue?

Systems using GPAC/MP4Box to process AC-4 files are exposed when an attacker can cause a crafted file to be provided to the affected processing path. The CVSS vector indicates user interaction is required.

What does an attacker need to exploit it?

An attacker needs only the ability to provide a crafted AC-4 file containing an out-of-range frame rate index. No authentication or special privileges are required.

How can I recognize exploitation or a triggering file?

A triggering file can cause an immediate process termination with a segmentation fault after an invalid frame_rate_index is used to access fixed-size AC-4 lookup tables. The reported crash involved a read at address 0x000000000000.