CVE-2025-60489: NULL pointer defence in GPAC/MP4Box dasher_insert_timeline_entry via crafted MP4 input
Published Oct 21, 2026
·Updated
A NULL pointer dereference in the dasherinserttimelineentry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
8 affected components
Gpac MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
debian/gpac
Event History
Oct 21, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·02:17 PM
Affected Software
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker provide to trigger the denial of service?
An attacker must supply a crafted MP4 file that reaches the dasher_insert_timeline_entry function in filters/dasher.c.
2
Which versions are affected?
GPAC MP4Box versions before 2.5 are affected.
3
What is the impact of successful exploitation?
Successful exploitation causes a NULL pointer dereference, resulting in a denial of service.