Executive brief
GPAC MP4Box is a popular open-source multimedia packager used to process and convert video and audio files. A vulnerability in how it handles AC4 audio files could allow an attacker to crash the application by providing a specially crafted file. This results in a denial-of-service, potentially disrupting automated media processing workflows or individual user operations.
Technical details
A NULL pointer dereference exists in the gf_ac4_pres_b_4_back_channels_present function within /media_tools/av_parsers.c of GPAC Project/MP4Box. The vulnerability is triggered when the parser fails to validate substream group references before accessing presentation data in AC4 streams. Specifically, an attacker can provide a crafted AC4 file that references an invalid group index, leading to a segmentation fault when the application attempts to access pres->substream_groups. This issue was addressed in commit 13eb5b7 and is fixed in version 26.02.0.
Affected products
- GPAC GPAC Project/MP4Box before 26.02.0
Timeline
- 2025-07-16: disclosed: Issue reported on GPAC GitHub repository
- 2026-06-01: advisory: CVE published to NVD