CVE-2025-71438 in MP4Box
Summary
by MITRE • 10/21/2026
An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as an out-of-bounds read within the gf_odf_ac4_cfg_dsi_v1 function located in the descriptors.c source file of the GPAC Project, specifically affecting versions prior to v26.07.0, represents a critical memory safety issue inherent to media parsing libraries. This flaw arises when the application processes an AC-3 or Enhanced AC-3 (E-AC-3) audio configuration descriptor within an MP4 container format. The function is responsible for decoding and validating specific metadata fields that define the coding parameters of the audio stream, such as sampling rate, channel count, and bit depth. When a maliciously crafted file containing malformed or truncated descriptors is supplied to the parser, the code fails to adequately validate the bounds of the input data before attempting to read from it. This lack of rigorous boundary checking allows an attacker to trigger a memory access violation by forcing the application to read beyond the allocated buffer limits defined by the descriptor structure.
From a technical perspective, this vulnerability is classified under CWE-125, which denotes Out-of-bounds Read. The core issue lies in the absence of proper length validation prior to accessing array elements or pointer dereferences within the configuration parsing logic. In C-based media parsers like those found in GPAC, such errors are particularly dangerous because they can lead to information disclosure if the out-of-bounds memory contains sensitive data, or more commonly, result in application crashes leading to a Denial of Service. The specific function gf_odf_ac4_cfg_dsi_v1 handles version 1 descriptors for AC-3 audio streams, and its failure to verify that the remaining buffer length is sufficient before reading configuration parameters creates an exploitable condition. An attacker can construct an MP4 file with carefully crafted header fields that trick the parser into believing there is more data available than actually exists in the stream segment being processed.
The operational impact of this vulnerability is primarily a Denial of Service against applications relying on GPAC or MP4Box for media processing, playback, or conversion. Since the out-of-bounds read typically results in an immediate segmentation fault or access violation within the process memory space, the application will crash upon encountering the malformed input. This disrupts service availability for any system that ingests untrusted video files, such as streaming platforms, content delivery networks, or local media players. While modern operating systems may mitigate some consequences through stack canaries and address space layout randomization, the fundamental instability remains a significant risk vector. In environments where automated processing of uploaded media is common, this vulnerability could be leveraged to exhaust server resources by repeatedly crashing worker processes handling malicious uploads.
This type of memory corruption flaw aligns with ATT&CK technique T1499, Endpoint Denial of Service, as it involves the disruption of normal system operations through resource exhaustion or application failure. Furthermore, it relates to CWE-20, Improper Input Validation, which is often a root cause for such buffer-related vulnerabilities in C/C++ applications. The exploitation does not require user interaction beyond uploading or opening the file, making it suitable for automated attacks against services that accept media uploads without rigorous sanitization.
To mitigate this vulnerability, organizations must upgrade to GPAC version v26.07.0 or later, where the issue has been addressed through improved input validation and bounds checking within the descriptor parsing functions. For systems unable to immediately patch, implementing strict file type verification and using sandboxed environments for processing untrusted media can reduce the attack surface. Additionally, integrating fuzzing tools into the continuous integration pipeline helps identify similar memory safety issues before they reach production. Developers should also enforce static analysis rules that flag potential out-of-bounds accesses in C codebases to prevent recurrence of such defects in future updates.