CVE-2025-71468 in GPAC
Summary
by MITRE • 11/15/2026
GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in src/media_tools/dash_client.c that allows attackers to crash applications via crafted DASH manifests. Attackers can supply an MPD whose AudioChannelConfiguration element omits schemeIdUri or value, crashing MP4Box or GPAC DASH clients and causing denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/15/2026
The vulnerability identified in versions of the GPAC multimedia framework prior to release 26.02.0 represents a critical stability issue rooted in improper input validation within its Dynamic Adaptive Streaming over HTTP client implementation. Specifically, the flaw resides in the gf_dash_group_get_audio_channels function located in the source file src/media_tools/dash_client.c. This component is responsible for parsing and interpreting Media Presentation Description files, which are XML-based manifests that describe how adaptive bitrate streaming content should be delivered to clients. The vulnerability arises when the parser encounters an AudioChannelConfiguration element within a crafted MPD file where either the schemeIdUri attribute or the value attribute is omitted. In standard DASH specifications, these attributes provide essential context for interpreting audio channel layouts and configurations. When they are missing, the internal logic of the GPAC client fails to handle this edge case gracefully, leading directly to a NULL pointer dereference condition.
From a technical perspective, this null pointer dereference occurs because the code attempts to access memory addresses or execute operations on data structures that were not properly initialized due to the absence of expected configuration parameters. Instead of validating the presence and integrity of these attributes before proceeding with audio channel group processing, the application assumes their existence based on default expectations. When a malicious actor supplies an MPD file lacking these specific fields, the pointer remains null or points to invalid memory locations. Subsequent execution attempts to dereference this null reference, causing immediate program termination. This behavior is characteristic of CWE-476, which classifies NULL Pointer Dereferences as vulnerabilities where software performs operations on a null pointer, typically resulting in crashes and denial of service conditions rather than arbitrary code execution unless specific exploitation contexts are present.
The operational impact of this vulnerability is primarily focused on availability through denial of service scenarios for users consuming DASH streams via MP4Box or other GPAC-based clients. Attackers can exploit this by distributing maliciously crafted MDP files, potentially through phishing campaigns, compromised streaming platforms, or man-in-the-middle attacks that modify manifest content in transit. Upon opening such a file, the client application will crash unexpectedly without providing meaningful error feedback to the user. This disrupts media playback and requires manual intervention to restart the application, degrading the user experience significantly. In enterprise environments where automated video processing pipelines rely on GPAC for stream analysis or conversion, this vulnerability could cause service interruptions across multiple downstream systems dependent on stable client-side parsing behavior.
Mitigation strategies should prioritize immediate software updates as the primary defense mechanism. Organizations and individual users must upgrade to version 26.02.0 of GPAC or any later release where developers have implemented robust input validation checks within the gf_dash_group_get_audio_channels function. These patches likely include explicit verification that schemeIdUri and value attributes are present before proceeding with audio configuration logic, ensuring null pointers are never generated from malformed inputs. Additionally, defensive coding practices such as using safe parsing libraries or implementing strict schema validation against official DASH standards can prevent similar issues in future developments. Security teams should also monitor for any reported incidents involving unexpected crashes in media players and correlate them with this specific vulnerability to ensure affected systems are patched promptly.
This incident aligns with ATT&CK technique T1496, which involves Resource Hijacking through denial of service via resource exhaustion or application instability caused by malformed inputs. While the primary goal here is not data exfiltration but rather system disruption, understanding how attackers leverage specification ambiguities to trigger internal errors helps in building more resilient media processing infrastructure. By enforcing strict adherence to DASH specifications during manifest validation and ensuring that all optional elements are handled with appropriate fallback logic or explicit error handling, developers can significantly reduce the attack surface for such parsing-related vulnerabilities. Continuous integration of fuzzing tools targeting MPD parsers further aids in identifying these edge cases before they reach production environments.