CVE-2025-70116

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing descriptor fields (e.g., codec/mime/profile strings). gf_media_map_esd then calls strlen() on a NULL pointer, triggering a crash (ASan SEGV).

Published 2026-05-27. Last modified 2026-10-05.