CVE-2025-71466

CVSS 6.8 (medium) · published 2026-11-15

GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in m2tsdmx_update_sdt() in src/filters/dmx_m2ts.c that allows attackers to crash the MPEG-2 TS demuxer. Attackers can supply a crafted .ts file with an invalid service descriptor leaving service or provider names NULL to crash MP4Box and cause denial of service.

Weakness: CWE-476

Source: NVD CVE-2025-71466

References

• https://github.com/gpac/gpac/blob/v2.4.0/src/filters/dmx_m2ts.c#L185-L189
• https://github.com/gpac/gpac/commit/62714f27c64a3d1eb7e880f9eed2d38673cb43ce
• https://github.com/gpac/gpac/issues/3267
• https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/26/26_m2tsdmx_update_sdt_filters_dmx_m2ts_c_218
• https://www.vulncheck.com/advisories/gpac-before-26.02.0-null-pointer-dereference-via-m2tsdmx-update-sdt

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.