GPAC MP4Box NULL dereference via crafted XML (CVE-2025-60487)
Original title: CVE-2025-60487: NULL pointer dereference in GPAC/MP4Box gf_isom_get_esd via crafted XML input
gf_isom_get_esd() crashes on near-NULL; fixed in commit e6d01820, CVSS 6.2.
Alexander A. Shvedov reported CVE-2025-60487, a NULL pointer dereference (CWE-476) in GPAC MP4Box. Crafted XML input causes gf_isom_get_esd() to dereference a near-NULL pointer. The affected build is 2.5-DEV-rev1665-g3f20eb0cd-master, fixed by commit e6d01820d7bf3967d931fedb379ee5f209bc133b. CVSS 3.1 is 6.2 Medium and cites a BDU assessment, with high availability impact and no user interaction.
- The vector is local, low complexity, with no privileges or user interaction.
- Confidentiality and integrity impacts are rated none.
- Affected commit is 3f20eb0cd22116367c036e6ffe6ace299b38d686.
- The report was posted on October 23.
Impact: Denial of service from crafted XML input
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1665-g3f20eb0cd-master | e6d01820d7bf3967d931fedb379ee5f209bc133b |
- 1.Update MP4Box to commit e6d01820d7bf3967d931fedb379ee5f209bc133b.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60487 | A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of… | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 3f20eb0cd22116367c036e6ffe6ace299b38d686 | (MP4Box) Affected: 2.5-DEV-rev1665-g3f20eb0cd-master Commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 Fixed: e6d01820d7bf3967d931fedb379ee5f209bc133b CVE: CVE-20 |
| sha1 | e6d01820d7bf3967d931fedb379ee5f209bc133b | ster Commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 Fixed: e6d01820d7bf3967d931fedb379ee5f209bc133b CVE: CVE-2025-60487 CWE: CWE-476 (NULL Pointer Dereference) |
From the original article
Posted by Alexander A. Shvedov on Oct 23 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1665-g3f20eb0cd-master Commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 Fixed: e6d01820d7bf3967d931fedb379ee5f209bc133b CVE: CVE-2025-60487 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.