CVE-2025-71466
Deferred Deferred - Pending Action

NULL Pointer Dereference in GPAC MP4Box via Malformed MPEG-2 TS File

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulnCheck

Description
GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in m2tsdmx_update_sdt() in src/filters/dmx_m2ts.c that allows attackers to crash the MPEG-2 TS demuxer. Attackers can supply a crafted .ts file with an invalid service descriptor leaving service or provider names NULL to crash MP4Box and cause denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2025-71466
EUVD
EUVD-2025-211341

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gpac gpac From 0 (inc) to 26.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-71466 is a NULL pointer dereference vulnerability in GPAC before version 26.02.0. It occurs in the m2tsdmx_update_sdt() function in src/filters/dmx_m2ts.c. Attackers can exploit this by providing a crafted .ts file with invalid service descriptors where service or provider names are NULL. This causes the MPEG-2 TS demuxer to crash, leading to denial of service.

Detection Guidance

To detect this vulnerability, check the GPAC version installed on your system. If it is below 26.02.0, the system is vulnerable. Run 'mp4box -version' to check the installed version. Additionally, monitor for crashes when processing .ts files, especially those with invalid service descriptors.

Impact Analysis

This vulnerability allows attackers to crash MP4Box by supplying a malformed .ts file, causing denial of service. Users processing such files may experience application crashes, data loss, or system instability. The impact is limited to systems using vulnerable GPAC versions.

Compliance Impact

This vulnerability primarily causes denial of service by crashing MP4Box through a NULL pointer dereference in the MPEG-2 TS demuxer. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR or HIPAA compliance. However, repeated crashes could disrupt system availability, potentially impacting service continuity required by these regulations.

Mitigation Strategies

Immediately update GPAC to version 26.02.0 or later to patch the vulnerability. If updating is not possible, avoid processing untrusted .ts files, particularly those with invalid service descriptors. Implement input validation for media files before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71466. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...