GPAC MP4Box Out-of-Bounds Read Flaw Exposes Systems to Crafted AC-4 Streams

Managed service providers must assess their media processing infrastructure for exposure to a newly disclosed vulnerability in GPAC. The flaw, tracked as CVE-2025-71438, resides in the MP4Box component and allows an out-of-bounds read operation. This issue arises when the software processes crafted AC-4 audio streams containing an invalid frame rate index. The researcher Alexander A. Shvedov posted the advisory on October 22, detailing how the gf_odf_ac4_cfg_dsi_v1 function fails to validate user-supplied data before indexing into fixed-size lookup tables.

How it unfolded

• Alexander A. Shvedov identified the out-of-bounds read vulnerability in the GPAC codebase.
• The researcher published the advisory on the oss-security mailing list on October 22.
• The report specified that the flaw exists in versions prior to the fix commit referenced in the advisory.

Who is affected

Organizations using GPAC or its MP4Box utility are at risk if they process untrusted AC-4 audio files. The vulnerability specifically impacts the gf_odf_ac4_cfg_dsi_v1 function within the odf/descriptors.c file. According to the advisory, the issue affects all GPAC versions released before the specific fix commit. The Common Weakness Enumeration classifies this as CWE-125, an out-of-bounds read. This means the application reads memory locations outside the intended buffer boundaries, which can lead to information disclosure or application instability.

Our take on the response

The disclosure provides clear technical details about the affected function and the specific input vector. By identifying the exact frame rate index manipulation required, the advisory allows defenders to create targeted detection rules. The CVSS score of 5.4 reflects the requirement for user interaction, which limits the attack surface compared to remote code execution flaws. That suggests the risk is manageable for systems that do not automatically process untrusted media files from external sources without human intervention.

Who needs to act first

Teams should prioritize updating any media transcoding or processing pipelines that handle AC-4 audio formats. Check whether your infrastructure accepts external media files from untrusted sources. If automatic processing occurs, isolate those systems from sensitive data networks. Verify if the current GPAC version matches the pre-fix state described in the advisory. Roll out updates to exposed systems first, then test the patched version in a staging environment to ensure compatibility with existing workflows. Back up configuration files before making changes.

What to do and how to stay safe: GPAC

• Verify the current GPAC version installed on all media processing servers and compare it against the fixed commit.
• Restrict the ability of user-facing applications to automatically process AC-4 audio files from untrusted sources.
• Implement input validation at the network edge to block malformed media streams before they reach processing applications.
• Monitor system logs for unusual memory access errors or crashes that may indicate exploitation attempts.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2025-71438?

The CVSS 3.1 score is 5.4, which is rated as Medium severity.

Does this vulnerability require user interaction to exploit?

Yes, the CVSS vector indicates that user interaction (UI:R) is required for successful exploitation.

Which specific function in GPAC is affected by this flaw?

The gf_odf_ac4_cfg_dsi_v1 function in the odf/descriptors.c file is affected.