https://seclists.org/oss-sec/2026/q4/377: CVE-2025-60493: GPAC/MP4Box: NULL Pointer Defence in check_media_profile via Crafted MP4 Input
Published Oct 24, 2026
·Updated
Affected Software
1 affected component
Gpac MP4Box=2.5-DEV-rev1699-g31becc9e0-master
Frequently Asked Questions
1
What conditions are required to trigger the crash?
An attacker must cause MP4Box to process a crafted or truncated MP4 containing invalid MPEG-4 Object Descriptors. The reported reproduction uses the -nosys option while processing the malicious file.
2
What is the practical impact of successful exploitation?
The reported impact is an immediate MP4Box crash, resulting in denial of service. The observed fault is a near-NULL read, and arbitrary code execution was not demonstrated.
3
Which build is known to be affected and what fixes it?
The issue was reproduced in GPAC 2.5-DEV-rev1699-g31becc9e0-master at commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9. The listed fix is commit 9afeea23f5c6584c02aefe1e1560c2844dfb8f7e.