CVE-2025-60479: Null Pointer Dereference

Q: Which MP4Box installations are affected?

GPAC Project MP4Box versions before 2.5 are affected. The issue is in the StatSFVec2f function in /scene_manager/scene_stats.c.

Q: What does an attacker need to exploit this issue?

An attacker needs to supply a crafted MPEG-4 file that is processed by the affected MP4Box installation. Successful exploitation causes a NULL pointer dereference and denial of service.

Q: Is this a denial-of-service issue or does the available information indicate code execution?

The provided information identifies the impact as denial of service caused by a NULL pointer dereference. It does not state that code execution or other impacts are possible.

Published Oct 21, 2026

Updated

A NULL pointer dereference in the StatSFVec2f function (/scenemanager/scenestats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.

Affected Software

1 affected component

Gpac Project MP4Box<2.5

Event History

Oct 21, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which MP4Box installations are affected?

GPAC Project MP4Box versions before 2.5 are affected. The issue is in the StatSFVec2f function in /scene_manager/scene_stats.c.

What does an attacker need to exploit this issue?

An attacker needs to supply a crafted MPEG-4 file that is processed by the affected MP4Box installation. Successful exploitation causes a NULL pointer dereference and denial of service.

Is this a denial-of-service issue or does the available information indicate code execution?

The provided information identifies the impact as denial of service caused by a NULL pointer dereference. It does not state that code execution or other impacts are possible.

CVE-2025-60479: Null Pointer Dereference

Affected Software

Event History

Frequently Asked Questions

Which MP4Box installations are affected?

What does an attacker need to exploit this issue?

Is this a denial-of-service issue or does the available information indicate code execution?

Company

Resources

Contact

Frequently Asked Questions

Which MP4Box installations are affected?

What does an attacker need to exploit this issue?

Is this a denial-of-service issue or does the available information indicate code execution?