EUVD-2025-211338

GPAC before 26.02.0 contains a type confusion vulnerability in ctxloadprocess that passes non-object descriptors to ODSSetupOD without checking the descriptor tag. Attackers can supply a crafted XMT file with a URL-bearing descriptor that crashes MP4Box or other GPAC-based applications in...

CVE-2025-71469

GPAC versions prior to 26.02.0 are susceptible to a type confusion vulnerability within the ctxload_process() function. The root cause is the failure to verify descriptor tags before passing non-object descriptors to ODS_SetupOD(). An attacker can trigger a denial of service (DoS) by providing a ...