CVE-2025-71467

CVSS 6.8 (medium) · published 2026-11-15

GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_node_get_field_by_name() in src/scenegraph/base_scenegraph.c that lets attackers crash applications. Attackers can supply a crafted XMT scene referencing a never-created node to crash MP4Box or GPAC scene loader applications, causing denial of service.

Weakness: CWE-476

Source: NVD CVE-2025-71467

References

• https://github.com/gpac/gpac/blob/v2.4.0/src/scenegraph/base_scenegraph.c#L2083-L2087
• https://github.com/gpac/gpac/commit/62714f27c64a3d1eb7e880f9eed2d38673cb43ce
• https://github.com/gpac/gpac/issues/3268
• https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/27/27_gf_node_get_field_by_name_scenegraph_base_scenegraph_c_2088
• https://www.vulncheck.com/advisories/gpac-before-26.02.0-null-pointer-dereference-via-gf-node-get-field-by-name

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.