https://seclists.org/oss-sec/2026/q4/326: CVE-2025-60479: NULL pointer defence in GPAC/MP4Box StatSFVec2f via crafted BIFS scene
Published Oct 22, 2026
·Updated
Affected Software
1 affected component
Gpac MP4Box=2.5-DEV-rev1678-gb7ffd9f96-master
An attacker needs to supply a crafted MPEG-4 file containing a malformed BIFS scene with an SFVec2f field. The file must be processed by MP4Box using the scene-statistics command, such as the -nstat invocation in the reproduction.
Systems or workflows that run MP4Box scene-statistics processing on MPEG-4 files from untrusted sources are exposed to denial of service. The reported impact is an immediate MP4Box crash; arbitrary code execution was not demonstrated.
The issue was reproduced in the 2.5 development build at commit b7ffd9f96bc188dde148300d8c4e510b557563aa. The listed fix is commit 75786eb61b7cc838b57c3d4f8004b4f13b5b724c, so source builds can be checked for inclusion of that fix.
Avoid running the scene-statistics command on untrusted MPEG-4/BIFS files. Restrict processing to trusted inputs until the fixed commit can be deployed.