https://seclists.org/oss-sec/2026/q4/323: CVE-2025-60469: NULL pointer defence in GPAC/MP4Box AC-4 parser via crafted file
Published Oct 22, 2026
·Updated
Affected Software
1 affected component
Gpac MP4Box=2.5-DEV-rev1593-gfe88c3545-master
Frequently Asked Questions
1
Who is exposed to this issue?
Systems that use MP4Box to process untrusted AC-4 files are exposed. Exploitation requires a user or workflow to provide a crafted AC-4 stream to MP4Box for parsing.
2
What does an attacker need to include in a malicious file?
The crafted AC-4 stream declares an unsupported presentation version and omits required substream group information. This causes the parser's error path to reach gf_ac4_presentation_ch_mode() with a NULL or invalid pointer.
3
What is the practical impact of successful exploitation?
Processing the file can crash MP4Box, causing a denial of service. The reported fault is a near-NULL read, and arbitrary code execution was not demonstrated.
4
Which affected build and fix commit are identified?
The issue was reproduced in GPAC 2.5-DEV-rev1593-gfe88c3545-master at commit fe88c3545aadd597b250ccf23271d5d3de50ccc8. The identified fix is commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.