Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

GPAC MP4Box invalid read via crafted MP4 (CVE-2025-60494)

Original title: CVE-2025-60494: invalid memory read in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input

oss-security ()1 · 1 read
Read at seclists.org
Part of a story covered by 7 sourcesTen GPAC MP4Box memory bugs disclosed on oss-securityMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A local NULL-pointer read can crash MP4Box; CVSS is 5.5 and a fix commit is named.

Alexander A. Shvedov reported CVE-2025-60494 in GPAC's MP4Box: a crafted MP4 causes an invalid memory read in gf_props_equal_internal(). The issue is CWE-476, a NULL pointer dereference, scored CVSS 3.1 5.5 with local access, user interaction, and high availability impact only. The affected build is 2.5-DEV-rev1699-g31becc9e0-master, commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9, fixed by fcb9083292befe61d3e2466b18edfedba49da098. The post was dated October 23 and the description is truncated.

Unconfirmed: The mailing-list snippet cuts off the technical description.

Key facts
  • CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
  • The reporter is Alexander A. Shvedov (@sigdevel).
  • The fixed commit is fcb9083292befe61d3e2466b18edfedba49da098.
  • No exploitation status is stated in the snippet.
Security assessment · AI, from the article

Impact: local crash of MP4Box via a crafted MP4

ProductAffectedFixed in
GPAC MP4Box2.5-DEV-rev1699-g31becc9e0-master (commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9)fcb9083292befe61d3e2466b18edfedba49da098
What to do
  1. 1.Update GPAC/MP4Box to commit fcb9083292befe61d3e2466b18edfedba49da098 or later.
Analyze CVE-2025-60494 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2025-60494
Tags
gpacmp4boxnull-dereferencemedia-parsingdenial-of-service
Vendors
GPAC
Products
MP4Box

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2025-60494
A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a…
5.5—

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
sha131becc9e08b88e525a4a62013a4000de1c0f8fd9(MP4Box) Affected: 2.5-DEV-rev1699-g31becc9e0-master Commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 Fixed: fcb9083292befe61d3e2466b18edfedba49da098 CVE: CVE-20
sha1fcb9083292befe61d3e2466b18edfedba49da098ster Commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 Fixed: fcb9083292befe61d3e2466b18edfedba49da098 CVE: CVE-2025-60494 CWE: CWE-476 (NULL Pointer Dereference)

From the original article

Posted by Alexander A. Shvedov on Oct 23 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1699-g31becc9e0-master Commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 Fixed: fcb9083292befe61d3e2466b18edfedba49da098 CVE: CVE-2025-60494 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.