https://seclists.org/oss-sec/2026/q4/349: CVE-2025-60487: NULL pointer defence in GPAC/MP4Box gf_isom_get_esd via crafted XML input
Affected Software
Frequently Asked Questions
Which usage is exposed to this issue?
MP4Box is exposed when it processes attacker-controlled XML through the NAL-dump command. The reported trigger is an empty or minimal XML input passed to MP4Box with -dnal 1.
What does an attacker need to cause an impact?
An attacker needs to cause MP4Box to process a crafted XML file using the affected NAL-dump workflow. No privileges or user interaction are listed in the supplied CVSS vector, and the reported impact is an immediate crash and denial of service.
What version or change should be used to remediate the issue?
The issue was reproduced in 2.5-DEV-rev1665-g3f20eb0cd-master at commit 3f20eb0cd22116367c036e6ffe6ace299b38d686. The supplied fix is commit e6d01820d7bf3967d931fedb379ee5f209bc133b.
How can I check whether an affected build crashes?
The report reproduces the fault by building GPAC with AddressSanitizer and running ./MP4Box -dnal 1 56_gf_isom_get_esd_isomedia_isom_read_c_1386.xml. An affected build may produce an AddressSanitizer segmentation fault involving a near-NULL read at address 0x50.