PT-2025-30079 · Gpac+3 · Gpac+3

Cybergym · Published 2025-07-18 · Updated 2025-10-03 · CVE-2025-7797

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions GPAC versions up to 2.4

Description A null pointer dereference issue exists in the gf dash download init segment function within the src/media tools/dash client.c file. Manipulation of the base init url argument can trigger this issue. This can be exploited remotely. The exploit has been publicly disclosed.

Recommendations Apply the patch identified as 153ea314b6b053db17164f8bc3c7e1e460938eaa.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

BDU:2025-11267

CVE-2025-7797

Affected Products

Astra Linux

Debian

Gpac

Red Os

References · 20

• 🔥 https://drive.google.com/file/d/1Z-C6RajpZ40ujo1iGNt3_mG855mPbs1Q/view?usp=share_link · Exploit
• https://github.com/gpac/gpac/commit/153ea314b6b053db17164f8bc3c7e1e460938eaa · Patch
• https://bdu.fstec.ru/vul/2025-11267 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7797 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-7797 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-7797 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-7797 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-7797 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-7797 · Vendor Advisory
• https://vuldb.com/?submit.616664 · Note
• https://t.me/cvetracker/28161 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-gpac-cve-2025-7797 · Note
• https://t.me/cveNotify/137328 · Telegram Post