CVE-2025-60487: NULL pointer defence in GPAC/MP4Box gf_isom_get_esd via crafted XML input
Published Oct 21, 2026
·Updated
A segmentation violation in the gfisomgetesd function (/isomedia/isomread.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.
Affected Software
8 affected components
Gpac MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
debian/gpac
Event History
Oct 21, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·03:17 PM
Affected Software
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Users of GPAC MP4Box versions before 2.5 are exposed when they process an attacker-supplied crafted XML file.
2
What does an attacker need to exploit the vulnerability?
An attacker needs to supply a crafted XML file that is processed by the affected MP4Box functionality. The reported impact is denial of service through a segmentation violation.
3
What is the available remediation?
Upgrade GPAC MP4Box to version 2.5 or later. The issue affects versions before 2.5.