MP4Box NULL dereference via crafted MP4 (CVE-2025-60493)
A third-party CVSS 3.1 score of 4.3 rates the user-triggered flaw as a low-availability denial of service.
28
Vulnerability1 · 1 read
CVE-2025-60493
NULL pointer dereference DoS in GPAC MP4Box before 2.5
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
GPAC MP4Box before version 2.5 has a segmentation violation (NULL pointer dereference) in the check_media_profile function in mp4box/mp4box.c. An attacker can trigger it by supplying a crafted MP4 file for MP4Box to process, causing the process to crash. The impact is denial of service only; there is no indication of code execution or data theft. Anyone running affected MP4Box builds—including media workflows and services that automatically inspect untrusted MP4 files—is affected. There is no known public proof of concept and no evidence of exploitation in the wild, and the issue has not been added to the CISA KEV catalog.
What to do: Upgrade GPAC/MP4Box to version 2.5 or later. Until then, do not process untrusted or user-supplied MP4 files with affected builds, and run any automated media inspection in an isolated, restartable sandbox so a crash cannot disrupt the wider service.
| Product | Affected |
|---|---|
| GPAC MP4Box | before 2.5 |
Estimated exposure
moderateon the order of 10,000–100,000 installations (specialist media tool; no public install census) — MP4Box/GPAC is a widely packaged open-source multimedia utility used in professional and automated media workflows, but it is not a mass consumer product and no public active-install count is available.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- Weakness
- CWE-476
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H