CVE-2025-71467
Deferred Deferred - Pending Action

NULL Pointer Dereference in GPAC MP4Box

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulnCheck

Description
GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_node_get_field_by_name() in src/scenegraph/base_scenegraph.c that lets attackers crash applications. Attackers can supply a crafted XMT scene referencing a never-created node to crash MP4Box or GPAC scene loader applications, causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2025-71467
EUVD
EUVD-2025-211340

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gpac gpac From 0 (inc) to 26.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-71467 is a NULL pointer dereference vulnerability in GPAC versions before 26.02.0. It occurs in the function gf_node_get_field_by_name() in src/scenegraph/base_scenegraph.c. Attackers can exploit this by providing a maliciously crafted XMT scene file that references a non-existent node, causing a segmentation fault and crashing applications like MP4Box or GPAC scene loader.

Detection Guidance

To detect this vulnerability, monitor for crashes in GPAC applications like MP4Box when processing XMT scene files. Use AddressSanitizer or similar tools to detect segmentation faults in gf_node_get_field_by_name(). Test with crafted files referencing non-existent nodes to trigger crashes.

Impact Analysis

This vulnerability allows attackers to crash applications processing media files, leading to denial-of-service conditions. Users of GPAC or MP4Box tools may experience unexpected application crashes when opening specially crafted files, disrupting media processing workflows.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing applications through crafted XMT scene files. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, service disruptions from crashes could indirectly affect compliance by impairing system availability required for processing personal or health data.

Mitigation Strategies

Upgrade GPAC to version 26.02.0 or later to apply the patch for this vulnerability. Avoid processing untrusted XMT or MPEG-4 scene files until the update is applied. Monitor vendor advisories for additional mitigations or updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71467. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...