https://seclists.org/oss-sec/2026/q4/355: CVE-2025-60497: NULL pointer defence in GPAC/MP4Box GetESD via crafted MP4 input
Published Oct 23, 2026
·Updated
Affected Software
1 affected component
Gpac MP4Box=2.5-DEV-rev1780-g50b5741f2-master
Frequently Asked Questions
1
Who can trigger the crash?
An attacker would need to provide a crafted MP4 file and have a user process it with MP4Box in the scene-export path. The CVSS vector indicates local access and user interaction are required.
2
Is arbitrary code execution known to be possible?
No. The reported impact is an immediate MP4Box crash and denial of service from a NULL read; arbitrary code execution was not demonstrated.
3
How can I determine whether my build is affected?
The issue was reproduced in GPAC 2.5-DEV-rev1780-g50b5741f2-master, at commit 50b5741f291126b610c59db433fc02e8a17f0c5d. The listed fix is commit 91083fcfce01aa596a13a6962768d13a60bfc8bb.