EUVD-2025-211165
GHSA-r6xg-c7j9-3q6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious AC4 file
-
DeliveryDeliver file to victim or pipeline
-
ExploitVictim parses file with MP4Box/GPAC
-
ExecutionNULL pointer dereference in gf_ac4_presentation_ch_mode
-
ImpactProcess crash / denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim or automated workflow to parse an attacker-crafted AC4 file using MP4Box/GPAC before version 2.5; the trigger is a NULL pointer dereference in gf_ac4_presentation_ch_mode during AC4 presentation/substream parsing. Limiting factors: the attack is local (AV:L) and requires user interaction (UI:R) - the attacker cannot reach the parser remotely without the victim choosing to process the malicious file - and impact is confined to a denial of service (process crash), with no confidentiality or integrity effect and no code execution indicated in the sources. No special non-default configuration is called out; any invocation that feeds an untrusted AC4 stream to the vulnerable parser is sufficient. |
| Impact | Signals are consistent and point to a genuine but moderate-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local, availability-only flaw: there is no confidentiality or integrity impact, and exploitation requires the victim to process an attacker-supplied file (UI:R), so this is not a remotely reachable service vulnerability. EPSS is low at 0.18% (7th percentile), the CVE is NOT on the CISA KEV list, and the available PoC is a reference only, not verified as working exploit code - so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month', which aligns with a patch-in-normal-cycle posture rather than emergency. There is no SSVC exploitation/automatable/technical-impact breakdown in the input to cite directly. Net: a real, legitimately patchable DoS bug in a file parser, but a medium-severity, user-interaction-gated issue - not a high-real-risk emergency despite being memory-safety related. |
| Exploit ScenarioDerived | An attacker crafts a malformed AC4 file and gets a victim to process it with MP4Box/GPAC before 2.5 (for example via a media-conversion pipeline, upload handler, or manual inspection). During AC4 parsing, gf_ac4_presentation_ch_mode dereferences a NULL group/substream pointer, crashing the process and causing a denial of service. A public PoC reference exists; it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
A NULL pointer dereference in GPAC's AC-4 parser (gf_ac4_presentation_ch_mode in src/media_tools/av_parsers.c) crashes MP4Box and other GPAC-based tools when they process a crafted AC4 file, giving an attacker a denial-of-service condition against the parsing process. GPAC releases before 2.5 are affected; the attack is local and requires the victim or an automated workflow to open the malicious file (AV:L, UI:R), and the assessed impact is availability only, with no confidentiality or integrity effect and no code execution indicated by the sources. There is no CISA KEV entry, EPSS is 0.18% (7th percentile), and a public PoC reference exists but is not verified as working exploit code, so this fits a normal monthly patch cadence rather than an emergency response.
RemediationAI
Vendor-released patch: GPAC 2.5, which contains the fix from commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b; upgrading to 2.5 or later is the complete remediation and should be scheduled in the normal monthly maintenance window given the this_month priority, local attack vector and availability-only impact. Full details are in the upstream issue https://github.com/gpac/gpac/issues/3292 and the oss-security advisory https://seclists.org/oss-sec/2026/q4/323. Where upgrading cannot happen immediately, the practical control is to stop feeding untrusted AC4 input to the vulnerable parser: do not run MP4Box or other GPAC-based tooling over AC4 files from untrusted sources or unattended ingestion pipelines until the upgrade lands, with the trade-off that legitimate AC-4 processing must be handled manually or by a different tool. If such parsing is unavoidable, run it in a sandboxed, low-privilege context with memory/restart supervision so that the NULL dereference crash is contained to the parsing job rather than the surrounding workflow - this limits blast radius only and does not fix the underlying defect, and upstream states the code fix as the resolution.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AC-4 is Dolby's object/immersive audio codec, and GPAC implements its configuration and frame parsing in src/media_tools/av_parsers.c and src/odf/descriptors.c, walking AC-4 presentation v1 structures that reference substream groups which in turn hold substreams. CWE-476 applies here: the upstream fix commit (e02d1fd2) shows that loops in gf_ac4_presentation_ch_mode, gf_ac4_presentation_channel_mask_v1 and gf_ac4_get_b_presentation_core_differs retrieved group and substream pointers from lists and used them without NULL checks, so a file describing a presentation whose group or substream entry is missing or empty leads to a NULL dereference. The same commit tightens array bounds (fs_index against AC4_SAMPLING_FREQ_TABLE, frame_rate_index against the 44.1 kHz and 48 kHz sample-delta/timescale tables, n_add_emdf_substreams against the substream_emdf_version and substream_key_id array lengths, name_len and n_targets in descriptors.c), adds an x != NULL guard in gf_ac4_get_presentation_by_substreamgroup, and corrects double-free behaviour in the temp_groups cleanup of gf_ac4_raw_frame, all of which point to malformed AC-4 configuration data producing missing or duplicated group references; the precise bitstream field that triggers the dereference is not described in the available sources beyond 'a crafted AC4 file'.
Know when Gpac gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local crafted-file parsing requiring the victim to open it gives AV:L/UI:R; no auth needed (PR:N); crash-only impact yields C:N/I:N and A:H for the terminated process.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitra
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.8), this vulnera
GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. Rated crit
Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. Rated critical severity (CVSS 9.8), this vulnerabilit
NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to e
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. Rated critical severity (CVSS 9.8), this
An issue was discovered in MP4Box in GPAC 0.7.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.1), this vulnerability
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded.c. Rated high severit
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Rated high sev
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
Exploit-DB