GPAC MP4Box CVE-2025-71438

Exploitation requires the victim to process an attacker-crafted AC4 audio file with GPAC/MP4Box (version before v26.07.0) - for example by opening, muxing, or transcoding it - which drives execution into the AC4 decoder-specific-info parser gf_odf_ac4_cfg_dsi_v1. The vector is local (AV:L) and requires user interaction (UI:R): the attacker cannot trigger it remotely without the target choosing to run MP4Box on the malicious file. No authentication is required per the CVSS vector (PR:N). Limiting factors: impact is confined to a crash/denial of service (A:H only; C:N/I:N) with no code execution or confirmed data disclosure, and real exposure is largely limited to environments that automatically ingest and parse untrusted media files (e.g., batch transcoding or DASH packaging pipelines). The precise byte-level trigger within the AC4 DSI structure is not detailed in the available sources beyond the missing null-check fixed by the vendor commit.

This is a genuine but modest-priority issue, not a high-severity emergency. The CVSS 3.1 base score is 5.5 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - a local attack vector requiring a victim to process an attacker-supplied file, producing availability-only impact (a crash). The EPSS score is very low at 0.16% (5th percentile), consistent with a local, interaction-dependent DoS that is not amenable to mass automated exploitation. The vulnerability is NOT on CISA KEV, so there is no confirmed active exploitation. The input provides a GitHub PoC reference, but it is explicitly 'reference only, not verified as working exploit code', so a public PoC reference exists but is not verified as working exploit code. The vuln.today decision label is 'this_month', which aligns with the low signals - a bug to patch on a normal cadence rather than drop everything for. Note a minor tension to verify: PR:N indicates no authentication is required, yet the practical precondition is that a user (or automated pipeline) must choose to run MP4Box against the malicious AC4 file (reflected by UI:R). The impact is bounded to denial of service (A:H, with C:N/I:N); CWE-125 (out-of-bounds read) can in principle leak memory, but the description and CVSS claim DoS only, so information disclosure should not be presented as confirmed.

An attacker crafts a malformed AC4 media file and gets a victim or an automated media-processing pipeline to open or transcode it with GPAC/MP4Box. During parsing of the AC4 decoder-specific information in gf_odf_ac4_cfg_dsi_v1, an out-of-bounds read occurs and the process crashes, denying service. A public PoC reference exists but is not verified as working exploit code, and no active exploitation is confirmed.