CVE-2025-70116EPSS p33.5%
CVE-2025-70116CVE-2025-70116
Description
A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing descriptor fields (e.g., codec/mime/profile strings). gf_media_map_esd then calls strlen() on a NULL pointer, triggering a crash (ASan SEGV).
Scoring
| CVSS | 4.3 () |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
| EPSS | 0.41% probability of exploitation · percentile 33.5% · 2026-08-03T12:00:16Z |
| Last modified | 2026-06-01 |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.