CVE-2025-71438: Out-of-bounds Read in GPAC/MP4Box via gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stream with invalid frame rate index

As cited

Copy frozen at 2026-10-22 22:38 UTC (site build).

vulnerabilities

CVE-2025-71438: Out-of-bounds Read in GPAC/MP4Box via gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stream with invalid frame rate index

CVE-2025-71438 is an out-of-bounds read vulnerability in GPAC/MP4Box's gf_odf_ac4_cfg_dsi_v1 function that processes AC-4 audio streams. The flaw arises when a crafted AC-4 file supplies an invalid frame rate index that indexes beyond fixed-size lookup tables in odf/descriptors.c. An attacker can trigger information disclosure or denial of service by delivering a malicious AC-4 stream to a user running vulnerable versions of GPAC prior to the fix commit.

Why it matters: Developers and users of GPAC/MP4Box need to patch or apply the fix commit to prevent out-of-bounds reads when processing untrusted AC-4 audio files, which could leak sensitive data or crash the application.

Source published

2026-10-22 20:04 UTC

First seen by Cybersecurity Tracker

2026-10-22 21:48 UTC