CVE-2025-60493: GPAC/MP4Box: NULL Pointer Defence in check_media_profile via Crafted MP4 Input
Published Oct 21, 2026
·Updated
A segmentation violation in the checkmediaprofile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
7 affected components
Gpac MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
Event History
Oct 21, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via OSV·03:17 PM
Affected Software
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
GPAC Project MP4Box versions before 2.5 are affected.
2
What must an attacker do to trigger the issue?
An attacker needs to supply a crafted MP4 file for MP4Box to process. The result is a segmentation violation that can cause denial of service.
3
How can I determine whether an installation is vulnerable?
Check the installed MP4Box version. Versions earlier than 2.5 are affected; version 2.5 and later are not identified as affected by the provided information.