CVE-2025-71468
Deferred Deferred - Pending Action

NULL Pointer Dereference in GPAC MP4Box via Malformed DASH Manifest

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulnCheck

Description
GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in src/media_tools/dash_client.c that allows attackers to crash applications via crafted DASH manifests. Attackers can supply an MPD whose AudioChannelConfiguration element omits schemeIdUri or value, crashing MP4Box or GPAC DASH clients and causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2025-71468
EUVD
EUVD-2025-211339

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gpac gpac From 0 (inc) to 26.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-71468 is a NULL pointer dereference vulnerability in GPAC before version 26.02.0. It occurs in the gf_dash_group_get_audio_channels() function in src/media_tools/dash_client.c. Attackers can exploit this by providing a malformed DASH manifest where the AudioChannelConfiguration element lacks schemeIdUri or value attributes. This causes a crash in MP4Box or GPAC DASH clients, leading to a denial of service.

Detection Guidance

To detect this vulnerability, inspect DASH manifest files for malformed AudioChannelConfiguration elements missing schemeIdUri or value attributes. Use MP4Box with AddressSanitizer to process suspicious MPD files: MP4Box -info malformed.mpd. If a crash occurs with a segmentation fault or AddressSanitizer error, the vulnerability may be present.

Impact Analysis

This vulnerability allows attackers to crash applications processing DASH media files. If you use GPAC tools like MP4Box to handle DASH manifests, an attacker could supply a malicious file causing the application to crash. This results in denial of service, disrupting media processing workflows.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a denial of service through application crashes in GPAC media processing tools. Compliance impacts would only occur if the affected software is used in systems handling regulated data, where crashes could disrupt processing or availability of critical media files.

Mitigation Strategies

Upgrade GPAC to version 26.02.0 or later to patch the vulnerability. If immediate upgrading is not possible, avoid processing untrusted DASH manifest files, especially those with missing AudioChannelConfiguration attributes. Implement input validation for MPD files to ensure proper structure before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71468. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...