MP4Box NULL dereference via crafted MP4 (CVE-2025-60493)
Original title: CVE-2025-60493: GPAC/MP4Box: NULL Pointer Dereference in check_media_profile via Crafted MP4 Input
A third-party CVSS 3.1 score of 4.3 rates the user-triggered flaw as a low-availability denial of service.
Alexander A. Shvedov reported CVE-2025-60493 in GPAC’s MP4Box. A crafted MP4 causes a near-NULL pointer dereference in check_media_profile, classified as CWE-476. The affected build is 2.5-DEV-rev1699-g31becc9e0-master at commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9, with the fix at commit 9afeea23f5c6584c02aefe1e1560c2844dfb8f7e. A third-party CVSS 3.1 assessment is 4.3 medium, with user interaction and low availability impact.
Unconfirmed: The feed snippet cuts off the vulnerability description.
- The weakness is CWE-476, NULL pointer dereference.
- No confidentiality or integrity impact is scored.
- The report was posted on October 24.
- The description in the feed snippet is truncated.
Impact: Crafted MP4 can crash MP4Box
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1699-g31becc9e0-master | 9afeea23f5c6584c02aefe1e1560c2844dfb8f7e |
- 1.Update GPAC to commit 9afeea23f5c6584c02aefe1e1560c2844dfb8f7e.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60493 | NULL pointer dereference DoS in GPAC MP4Box before 2.5 | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 31becc9e08b88e525a4a62013a4000de1c0f8fd9 | (MP4Box) Affected: 2.5-DEV-rev1699-g31becc9e0-master Commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 Fixed: 9afeea23f5c6584c02aefe1e1560c2844dfb8f7e CVE: CVE-20 |
| sha1 | 9afeea23f5c6584c02aefe1e1560c2844dfb8f7e | ster Commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 Fixed: 9afeea23f5c6584c02aefe1e1560c2844dfb8f7e CVE: CVE-2025-60493 CWE: CWE-476 (NULL Pointer Dereference) |
From the original article
Posted by Alexander A. Shvedov on Oct 24 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1699-g31becc9e0-master Commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 Fixed: 9afeea23f5c6584c02aefe1e1560c2844dfb8f7e CVE: CVE-2025-60493 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.