PT-2026-44037 · Gpac · Mp4Box

Published 2026-05-27 · Updated 2026-05-30 · CVE-2025-70116

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions GPAC MP4Box (affected versions not specified)

Description A NULL pointer dereference occurs when parsing certain truncated MP4 files. An unknown or invalid stsd entry can lead to missing descriptor fields, such as codec, mime, or profile strings. Consequently, the gf media map esd() function calls strlen() on a NULL pointer, resulting in a crash.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2025-70116

Affected Products

Mp4Box

References · 6

• 🔥 https://github.com/gpac/gpac/issues/3345 · Exploit
• 🔥 https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/68/68_gf_media_map_esd_media_tools_isom_tools_c_1364 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-70116 · Security Note
• https://infosec.exchange/@sigdevel/116624563750949972 · Note
• https://t.me/cveNotify/165313 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/30/2 · Note