Cyber ·
CVE-2025-71438: out-of-bounds read in GPAC/MP4Box via crafted AC-4 stream
Public advisory on an out-of-bounds read (CWE-125) in GPAC/MP4Box when processing an AC-4 stream with an invalid frame rate index. CVSS 3.1 score of 5.4, rated medium. Published on October 22, 2026 on the oss-sec mailing list.
According to the advisory published on the oss-sec mailing list on October 22, 2026, the function gf_odf_ac4_cfg_dsi_v1, in the file odf/descriptors.c of the GPAC project, uses a frame_rate_index supplied by the stream itself to index fixed-size lookup tables. A specially built AC-4 stream can cause an out-of-bounds read, classified as CWE-125.
The affected product is GPAC, including the MP4Box tool, in versions prior to the fix commit referenced in the original advisory. The CVSS 3.1 score is 5.4, medium severity, with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L: network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low impact on confidentiality and availability, and no impact on integrity.
To check your environment, look up the CVE identifier in official vulnerability databases, confirm the installed GPAC version, and compare it with the fix commit cited in the original advisory. Update the software as soon as your distribution ships the fix.
Relevance and privacy: this is a security advisory, and privacy is a secondary concern. If your team uses AI to study the advisory or plan the patch, do not paste logs, internal paths, configurations or client media files. Rota Nacional detects personal data such as CPF, CNPJ, email, phone numbers and names before any model runs and applies the organization's policy, but this does not replace human review of secrets and credentials.