DEBIAN-CVE-2025-70116

A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing descriptor fields e.g., codec/mime/profile strings. gfmediamapesd then calls strlen on a NULL pointer, triggering a crash ASan SEGV...

CVE-2025-70116

The GPAC MP4Box software is susceptible to a NULL pointer dereference when processing specific truncated MP4 files . The issue arises when an unknown or invalid stsd entry results in missing descriptor fields, such as codec, mime, or profile strings. Specifically, the gf_media_map_esd() function ...