MP4Box GetESD NULL dereference via crafted MP4 (CVE-2025-60497)
Original title: CVE-2025-60497: NULL pointer dereference in GPAC/MP4Box GetESD via crafted MP4 input
GPAC 2.5-DEV commit 50b5741f2 crashes locally when a user opens a crafted MP4; the fix is commit 91083fcf.
Alexander A. Shvedov reported CVE-2025-60497, a NULL pointer dereference in GPAC's MP4Box GetESD function. A crafted MP4 input can crash the tool. The affected build is 2.5-DEV-rev1780-g50b5741f2-master, commit 50b5741f291126b610c59db433fc02e8a17f0c5d, and the stated fix is commit 91083fcfce01aa596a13a6962768d13a60bfc8bb. CVSS 3.1 is 5.5 medium, with local access and user interaction required and only availability affected.
- CWE-476 NULL pointer dereference; CISA assessment is cited for the score.
- The vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
- Fixed commit is 91083fcfce01aa596a13a6962768d13a60bfc8bb.
- Reporter is Alexander A. Shvedov (@sigdevel).
Impact: Local denial of service when a crafted MP4 is opened
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1780-g50b5741f2-master (commit 50b5741f291126b610c59db433fc02e8a17f0c5d) | 91083fcfce01aa596a13a6962768d13a60bfc8bb |
- 1.Update GPAC MP4Box to commit 91083fcfce01aa596a13a6962768d13a60bfc8bb.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60497 | A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via… | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 50b5741f291126b610c59db433fc02e8a17f0c5d | (MP4Box) Affected: 2.5-DEV-rev1780-g50b5741f2-master Commit 50b5741f291126b610c59db433fc02e8a17f0c5d Fixed: 91083fcfce01aa596a13a6962768d13a60bfc8bb CVE: CVE-20 |
| sha1 | 91083fcfce01aa596a13a6962768d13a60bfc8bb | ster Commit 50b5741f291126b610c59db433fc02e8a17f0c5d Fixed: 91083fcfce01aa596a13a6962768d13a60bfc8bb CVE: CVE-2025-60497 CWE: CWE-476 (NULL Pointer Dereference) |
From the original article
Posted by Alexander A. Shvedov on Oct 23 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1780-g50b5741f2-master Commit 50b5741f291126b610c59db433fc02e8a17f0c5d Fixed: 91083fcfce01aa596a13a6962768d13a60bfc8bb CVE: CVE-2025-60497 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.