CVE-2025-60497: NULL pointer defence in GPAC/MP4Box GetESD via crafted MP4 input
Published Oct 21, 2026
·Updated
A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
7 affected components
Gpac Project MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
Event History
Oct 21, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via OSV·03:17 PM
Affected Software
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this denial-of-service issue?
Systems using GPAC Project MP4Box versions before 2.5 are affected when they process attacker-supplied MP4 files. The available information identifies the vulnerable code as the GetESD function in /isomedia/track.c.
2
What does an attacker need to exploit the issue?
An attacker needs to supply a crafted MP4 file for MP4Box to process. Successful exploitation can cause a denial of service through a segmentation violation.
3
How can I remediate the issue?
Upgrade MP4Box to version 2.5 or later. The issue is fixed by the referenced GPAC commit 91083fcfce01aa596a13a6962768d13a60bfc8bb.