CVE-2025-70116 | THREATINT

Description

A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing descriptor fields (e.g., codec/mime/profile strings). gf_media_map_esd then calls strlen() on a NULL pointer, triggering a crash (ASan SEGV).

PUBLISHED Reserved 2026-01-09 | Published 2026-05-27 | Updated 2026-05-27 | Assigner mitre

References

github.com/gpac/gpac/issues/3345

github.com/...gf_media_map_esd_media_tools_isom_tools_c_1364

infosec.exchange/@sigdevel/116624563750949972

cve.org (CVE-2025-70116)

nvd.nist.gov (CVE-2025-70116)

Download JSON