GPAC MP4Box out-of-bounds read on crafted AC-4 (CVE-2025-71438)
Original title: CVE-2025-71438: Out-of-bounds Read in GPAC/MP4Box via gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stream with invalid frame rate index
A stream-supplied frame_rate_index indexes fixed lookup tables; the snippet states no fix or affected build.
Alexander A. Shvedov reported an out-of-bounds read in GPAC MP4Box, tracked as CVE-2025-71438. Function gf_odf_ac4_cfg_dsi_v1 in odf/descriptors.c uses a stream-supplied frame_rate_index to index fixed-size lookup tables when parsing a crafted AC-4 stream with an invalid frame rate index. The oss-security snippet does not give affected or fixed versions.
Unconfirmed: The snippet does not state affected builds, a fix, or whether the flaw is exploited.
- Posted to oss-security on October 22 by Alexander A. Shvedov.
- The bug is in odf/descriptors.c, function gf_odf_ac4_cfg_dsi_v1.
- Trigger is a crafted AC-4 stream with an invalid frame rate index.
Impact: out-of-bounds read while parsing a crafted AC-4 stream
| Product | Affected |
|---|---|
| GPAC MP4Box | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-71438 | An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS)… | 5.5 | — |
From the original article
Posted by Alexander A. Shvedov on Oct 22 Product: GPAC (MP4Box) https://infosec. exchange/@sigdevel> Description: The gf_odf_ac4_cfg_dsi_v1 function in odf/descriptors.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.