Out-of-Bounds Read Vulnerability in GPAC MP4Box Media Player

CVE-2025-71438

What is CVE-2025-71438?

An out-of-bounds read vulnerability exists in the GPAC MP4Box media player, specifically within the function gf_odf_ac4_cfg_dsi_v1 located in odf/descriptors.c. This flaw enables attackers to exploit it by submitting a specially crafted AC4 file, resulting in a Denial of Service (DoS) condition. Potential impacts include service disruption and unavailability of the media player for legitimate users. It is crucial for users to ensure they are running the most recent versions of the software to mitigate this threat.

References