CVE-2025-71438
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 GPAC Project/MP4Box 的 v26.07.0 版本之前， 函数（位于 文件中）存在越界读取漏洞。攻击者可通过提供特制的 AC4 文件利用该漏洞，导致拒绝服务（DoS）。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-71438
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2025-71438
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-71438
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-71438 (1)
Vendor Advisories for CVE-2025-71438 (1)
Proof of Concept for CVE-2025-71438 (1)
Same Patch Batch · n/a · 2026-10-21 · 15 CVEs total
| CVE-2026-114262 | 7.3 HIGH | file-management-system FileController.php store unrestricted upload |
| CVE-2026-114362 | 6.3 MEDIUM | HarnessRouter Targets Test Endpoint app.py server-side request forgery |
| CVE-2026-114361 | 5.6 MEDIUM | HarnessRouter Identity Mode app.py improper authorization |
| CVE-2025-60489 | MP4Box 2.5 前版本 NULL 指针解引用漏洞 | |
| CVE-2025-60491 | GPAC MP4Box 2.5 前堆栈释放后使用漏洞 | |
| CVE-2025-60479 | GPAC/MP4Box 2.5 前 StatSFVec2f 空指针 DoS 漏洞 | |
| CVE-2025-60493 | GPAC MP4Box 2.5 前版本 DoS 漏洞 | |
| CVE-2025-60497 | MP4Box 2.5 前 GetESD 段错误导致拒绝服务 | |
| CVE-2025-60490 | GPAC MP4Box 2.5 前堆栈释放后使用漏洞 | |
| CVE-2025-60492 | MP4Box 2.5 前版本 gf_bifs_dec_node 栈溢出漏洞 | |
| CVE-2025-60487 | MP4Box 2.5 前 gf_isom_get_esd 段错误致 DoS 漏洞 | |
| CVE-2025-60478 | MP4Box 2.5 前版本 gf_filter_packet_destroy 释放后使用漏洞 | |
| CVE-2025-60469 | MP4Box 2.5 前 AC4 解析空指针解引用导致DoS | |
| CVE-2025-60476 | GPAC MP4Box 2.5 前堆栈释放后使用漏洞 |
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-114362
HarnessRouter Targets Test Endpoint app.py server-side reque -
CVE-2026-114361
HarnessRouter Identity Mode app.py improper authorization -
CVE-2026-114262
file-management-system FileController.php store unrestricted -
CVE-2025-60489
MP4Box 2.5 前版本 NULL 指针解引用漏洞 -
CVE-2025-60491
GPAC MP4Box 2.5 前堆栈释放后使用漏洞
V. Comments for CVE-2025-71438
No comments yet