GPAC MP4Box NULL dereference on crafted MP4 metadata (CVE-2025-60477)
The crash is in gf_filter_pid_resolve_file_template_ex while resolving DASH output file-name templates.
42
CVE-2025-60477
- CVSS 3.1
- 5.0 medium
- EPSS
- <1%p1
- Published
- ·
- Modified
Description · NVD
A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
- Weakness
- CWE-476
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H