CVE-2025-60479: NULL pointer defence in GPAC/MP4Box StatSFVec2f via crafted BIFS scene
Published Oct 21, 2026
·Updated
A NULL pointer dereference in the StatSFVec2f function (/scenemanager/scenestats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.
Affected Software
8 affected components
Gpac MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
debian/gpac
Event History
Oct 21, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·02:17 PM
Affected Software
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which MP4Box installations are affected?
GPAC Project MP4Box versions before 2.5 are affected. The issue is in the StatSFVec2f function in /scene_manager/scene_stats.c.
2
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted MPEG-4 file that is processed by the affected MP4Box installation. Successful exploitation causes a NULL pointer dereference and denial of service.
3
Is this a denial-of-service issue or does the available information indicate code execution?
The provided information identifies the impact as denial of service caused by a NULL pointer dereference. It does not state that code execution or other impacts are possible.