CVE-2025-7797 Overview
CVE-2025-7797 is a null pointer dereference vulnerability in GPAC multimedia framework versions up to 2.4. The flaw resides in the gf_dash_download_init_segment function within src/media_tools/dash_client.c. Manipulation of the base_init_url argument triggers a null pointer dereference, causing the application to crash. The vulnerability is remotely triggerable through crafted Dynamic Adaptive Streaming over HTTP (DASH) content. Public disclosure of exploitation details has occurred, and the maintainers have released a patch identified by commit hash 153ea314b6b053db17164f8bc3c7e1e460938eaa. The issue is categorized under [CWE-404] (Improper Resource Shutdown or Release).
Critical Impact
Remote attackers can crash GPAC-based media applications by supplying malformed DASH manifests that cause a null base_init_url value to reach segment initialization code.
Affected Products
- GPAC versions up to and including 2.4
- Applications embedding the GPAC libgpac DASH client
- Media pipelines using src/media_tools/dash_client.c for adaptive streaming
Discovery Timeline
- 2025-07-18 - CVE-2025-7797 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-7797
Vulnerability Analysis
GPAC is an open-source multimedia framework used for packaging, streaming, and playback of MPEG-DASH content. The vulnerability affects the DASH client component responsible for downloading initialization segments during adaptive streaming. When the function gf_dash_download_init_segment receives a null base_init_url argument, the code path dereferences the pointer without validation. This produces a segmentation fault that terminates the host process.
The issue impacts availability but not confidentiality or integrity. Exploitation requires no authentication and no user interaction beyond consuming a malicious DASH manifest. Server-side services that ingest untrusted DASH content are particularly exposed. An EPSS score of 0.87% places this at a moderate likelihood of exploitation attempts relative to other CVEs.
Root Cause
The defect stems from missing null-pointer validation on base_init_url before the pointer is used. Upstream parsing paths in the DASH client can produce a null URL when a manifest omits or malforms the initialization segment reference. Without a guard, the subsequent dereference in gf_dash_download_init_segment faults immediately.
Attack Vector
An attacker hosts a crafted DASH manifest (.mpd) referencing initialization segments that trigger a null base_init_url through parsing anomalies. A victim application—media player, transcoder, or streaming server—retrieves the manifest and invokes the DASH client. The null dereference then crashes the process, producing a denial of service against playback or streaming infrastructure.
// Patch: add null guard in gf_dash_download_init_segment()
// Source: https://github.com/gpac/gpac/commit/153ea314b6b053db17164f8bc3c7e1e460938eaa
return GF_NON_COMPLIANT_BITSTREAM;
}
+ if (!base_init_url) {
+ return GF_IO_ERR;
+ }
+
if (nb_segment_read) {
group->init_segment_is_media = GF_TRUE;
group->init_segment_start_number = start_number;
The patch adds an explicit null check that returns GF_IO_ERR before any dereference occurs, ensuring the function fails safely instead of crashing.
Detection Methods for CVE-2025-7797
Indicators of Compromise
- Unexpected termination or segmentation fault crashes of processes linked against libgpac versions ≤ 2.4
- Core dumps referencing gf_dash_download_init_segment in dash_client.c
- Repeated DASH manifest requests from a single source followed by media service crashes
- Application logs showing incomplete DASH initialization segment downloads before process exit
Detection Strategies
- Inventory hosts running GPAC binaries (MP4Box, MP4Client, gpac) and compare installed versions against 2.4 and earlier
- Monitor process supervisors (systemd, container orchestrators) for repeated restarts of media services processing external DASH content
- Inspect DASH manifests entering the environment for missing or malformed BaseURL and Initialization elements
Monitoring Recommendations
- Enable core dump collection on media processing hosts and route crash artifacts to centralized log storage
- Alert on abnormal restart rates for streaming daemons that consume third-party manifests
- Track outbound and inbound HTTP requests to .mpd endpoints and correlate with process crashes
How to Mitigate CVE-2025-7797
Immediate Actions Required
- Upgrade GPAC to a version containing commit 153ea314b6b053db17164f8bc3c7e1e460938eaa or later
- Rebuild any downstream applications that statically link libgpac against the patched source
- Restrict processing of untrusted DASH manifests until patching is complete
- Isolate GPAC-based services behind reverse proxies that validate manifest structure
Patch Information
The GPAC maintainers fixed the issue with commit 153ea314b6b053db17164f8bc3c7e1e460938eaa. The patch adds a null check on base_init_url at the top of gf_dash_download_init_segment and returns GF_IO_ERR when the value is absent. See the VulDB entry #316862 for additional metadata.
Workarounds
- Disable DASH playback in GPAC-based tools when handling untrusted content
- Pre-validate incoming .mpd files to ensure BaseURL and initialization segment references are well-formed
- Sandbox media processing workers so a crash is contained and automatically restarted without service disruption
# Build GPAC from patched source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 153ea314b6b053db17164f8bc3c7e1e460938eaa
./configure
make -j$(nproc)
sudo make install
# Verify installed version no longer matches vulnerable range
MP4Box -version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
