GPAC MP4Box NULL dereference via crafted MP4 (CVE-2025-60489)
Original title: CVE-2025-60489: NULL pointer dereference in GPAC/MP4Box dasher_insert_timeline_entry via crafted MP4 input
dasher_insert_timeline_entry() can crash on near-NULL; the fix commit is 4860a1a6.
Alexander A. Shvedov reported CVE-2025-60489, a NULL pointer dereference (CWE-476) in GPAC MP4Box. Crafted MP4 input makes dasher_insert_timeline_entry() dereference a near-NULL pointer. Affected revision 2.5-DEV-rev1692-g23819fdc0-master is fixed by commit 4860a1a6f128ccc9ae37b4b738d22029f9672457. CVSS 3.1 is 5.5 Medium, local, with high availability impact only.
- The vector requires local access and user interaction, with no privileges.
- Confidentiality and integrity impacts are rated none.
- Affected commit is 23819fdc02be8d3e92f0ef84831625d51981d7d2.
- Posted to oss-security on October 23.
Impact: Denial of service from a crafted MP4 file
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1692-g23819fdc0-master | 4860a1a6f128ccc9ae37b4b738d22029f9672457 |
- 1.Update MP4Box to commit 4860a1a6f128ccc9ae37b4b738d22029f9672457.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60489 | A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a… | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 23819fdc02be8d3e92f0ef84831625d51981d7d2 | (MP4Box) Affected: 2.5-DEV-rev1692-g23819fdc0-master Commit 23819fdc02be8d3e92f0ef84831625d51981d7d2 Fixed: 4860a1a6f128ccc9ae37b4b738d22029f9672457 CVE: CVE-20 |
| sha1 | 4860a1a6f128ccc9ae37b4b738d22029f9672457 | ster Commit 23819fdc02be8d3e92f0ef84831625d51981d7d2 Fixed: 4860a1a6f128ccc9ae37b4b738d22029f9672457 CVE: CVE-2025-60489 CWE: CWE-476 (NULL Pointer Dereference) |
From the original article
Posted by Alexander A. Shvedov on Oct 23 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1692-g23819fdc0-master Commit 23819fdc02be8d3e92f0ef84831625d51981d7d2 Fixed: 4860a1a6f128ccc9ae37b4b738d22029f9672457 CVE: CVE-2025-60489 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.