GPAC MP4Box AC-4 parser NULL dereference via crafted file (CVE-2025-60469)
Original title: CVE-2025-60469: NULL pointer dereference in GPAC/MP4Box AC-4 parser via crafted file
BDU scores the availability-only crash CVSS 5.5; the fix is commit e02d1fd24cdc.
Alexander A. Shvedov reported a NULL pointer dereference in GPAC's MP4Box while parsing a crafted file in the AC-4 parser. The affected build is 2.5-DEV-rev1593-gfe88c3545-master. The fix is commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b. BDU scored it CVSS 3.1 5.5 MEDIUM, with high availability impact only.
- CWE-476; vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
- Vulnerable commit is fe88c3545aadd597b250ccf23271d5d3de50ccc8.
- Posted on October 22 by Alexander A. Shvedov (@sigdevel).
- Confidentiality and integrity impacts are none in the CVSS vector.
Impact: NULL dereference crash while parsing a crafted file
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1593-gfe88c3545-master | e02d1fd24cdc26acb1b236ab38b3832cffcae21b |
- 1.Update GPAC to commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.
- CVEs
- CVE-2025-60469
- ATT&CK
- T1204.002 Malicious File
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60469 | A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause… | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | e02d1fd24cdc26acb1b236ab38b3832cffcae21b | ster Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-2025-60469 CWE: CWE-476 (NULL Pointer Dereference) |
| sha1 | fe88c3545aadd597b250ccf23271d5d3de50ccc8 | (MP4Box) Affected: 2.5-DEV-rev1593-gfe88c3545-master Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-20 |
From the original article
Posted by Alexander A. Shvedov on Oct 22 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1593-gfe88c3545-master Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-2025-60469 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.