Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

GPAC MP4Box NULL dereference via crafted BIFS (CVE-2025-60479)

Original title: CVE-2025-60479: NULL pointer dereference in GPAC/MP4Box StatSFVec2f via crafted BIFS scene

oss-security ()1 · 1 read
Read at seclists.org
Part of a story covered by 6 sourcesShvedov posts multiple unexploited GPAC MP4Box memory bugsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A crafted BIFS scene can crash StatSFVec2f locally; CVSS 3.1 is 5.5 and a fix commit is named.

Alexander A. Shvedov reported a NULL pointer dereference in GPAC MP4Box StatSFVec2f via a crafted BIFS scene. It is CWE-476 and rated CVSS 3.1 5.5 medium in a BDU assessment, with local access, required user interaction, and high availability impact only. The affected build is 2.5-DEV-rev1678-gb7ffd9f96-master; the stated fix is commit 75786eb61b7cc838b57c3d4f8004b4f13b5b724c.

Unconfirmed: The snippet is cut off, so details beyond the NULL dereference are not shown.

Key facts
  • Affected commit is b7ffd9f96bc188dde148300d8c4e510b557563aa.
  • Fixed commit is 75786eb61b7cc838b57c3d4f8004b4f13b5b724c.
  • CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
  • The snippet ends before the full crash description.
Security assessment · AI, from the article

Impact: local denial of service by crashing MP4Box

ProductAffectedFixed in
GPAC MP4Box2.5-DEV-rev1678-gb7ffd9f96-master75786eb61b7cc838b57c3d4f8004b4f13b5b724c
What to do
  1. 1.Update GPAC to commit 75786eb61b7cc838b57c3d4f8004b4f13b5b724c.
Analyze CVE-2025-60479 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2025-60479
Tags
gpacmp4boxnull-dereferencebifsdenial-of-service
Vendors
GPAC
Products
MP4Box

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2025-60479
A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of…
5.5—

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
sha175786eb61b7cc838b57c3d4f8004b4f13b5b724cster Commit b7ffd9f96bc188dde148300d8c4e510b557563aa Fixed: 75786eb61b7cc838b57c3d4f8004b4f13b5b724c CVE: CVE-2025-60479 CWE: CWE-476 (NULL Pointer Dereference)
sha1b7ffd9f96bc188dde148300d8c4e510b557563aa(MP4Box) Affected: 2.5-DEV-rev1678-gb7ffd9f96-master Commit b7ffd9f96bc188dde148300d8c4e510b557563aa Fixed: 75786eb61b7cc838b57c3d4f8004b4f13b5b724c CVE: CVE-20

From the original article

Posted by Alexander A. Shvedov on Oct 22 Subject: CVE-2025-60479: NULL pointer dereference in GPAC/MP4Box StatSFVec2f via crafted BIFS scene Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1678-gb7ffd9f96-master Commit b7ffd9f96bc188dde148300d8c4e510b557563aa Fixed: 75786eb61b7cc838b57c3d4f8004b4f13b5b724c CVE: CVE-2025-60479 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.