CVE-2025-60469: Null Pointer Dereference

Q: Who is exposed to this issue?

Systems using GPAC Project MP4Box versions before 2.5 are exposed when they process AC4 files from untrusted sources.

Q: What does an attacker need to exploit it?

An attacker needs to supply a crafted AC4 file for the affected MP4Box code path to process. Successful exploitation causes a denial of service through a NULL pointer dereference.

Q: How can I tell whether my deployment is affected?

Check whether MP4Box is from a GPAC release before 2.5 and whether it processes AC4 input. The vulnerable function is gf_ac4_presentation_ch_mode in media_tools/av_parsers.c.

Published Oct 21, 2026

Updated

A NULL pointer dereference in the gfac4presentationchmode function (/mediatools/avparsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

Affected Software

1 affected component

Gpac Project MP4Box<2.5

Event History

Oct 21, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Who is exposed to this issue?

Systems using GPAC Project MP4Box versions before 2.5 are exposed when they process AC4 files from untrusted sources.

What does an attacker need to exploit it?

An attacker needs to supply a crafted AC4 file for the affected MP4Box code path to process. Successful exploitation causes a denial of service through a NULL pointer dereference.

How can I tell whether my deployment is affected?

Check whether MP4Box is from a GPAC release before 2.5 and whether it processes AC4 input. The vulnerable function is gf_ac4_presentation_ch_mode in media_tools/av_parsers.c.

CVE-2025-60469: Null Pointer Dereference

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether my deployment is affected?