CVE-2025-60469: NULL pointer defence in GPAC/MP4Box AC-4 parser via crafted file
Published Oct 21, 2026
·Updated
A NULL pointer dereference in the gfac4presentationchmode function (/mediatools/avparsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Affected Software
8 affected components
Gpac Project MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
debian/gpac
Event History
Oct 21, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·04:17 PM
Affected Software
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Systems using GPAC Project MP4Box versions before 2.5 are exposed when they process AC4 files from untrusted sources.
2
What does an attacker need to exploit it?
An attacker needs to supply a crafted AC4 file for the affected MP4Box code path to process. Successful exploitation causes a denial of service through a NULL pointer dereference.
3
How can I tell whether my deployment is affected?
Check whether MP4Box is from a GPAC release before 2.5 and whether it processes AC4 input. The vulnerable function is gf_ac4_presentation_ch_mode in media_tools/av_parsers.c.