https://seclists.org/oss-sec/2026/q4/378: CVE-2025-60477: GPAC/MP4Box: NULL Pointer Defence in gf_filter_pid_solve_file_template_ex on crafted MP4 with special metadata

Q: Who is realistically exposed to this issue?

Users or services that run MP4Box DASH segmentation on attacker-supplied or otherwise untrusted MP4 files are exposed. Exploitation requires only the ability to provide a crafted input file; no authentication or special privileges are required.

Q: Does exploitation require a particular MP4Box operation?

The vulnerable function resolves output filename templates during DASH segmentation. The provided reproduction invokes MP4Box with the -dash option, so exposure is specifically evidenced for DASH processing of a crafted MP4.

Q: What is the practical impact of successful exploitation?

A crafted file can cause a NULL-pointer read in strncmp(), immediately terminating the MP4Box process. The reported impact is denial of service, and no arbitrary code execution was observed.

Q: How can I tell whether my deployment is affected?

The issue was reproducible on the current master branch at the time of discovery and affects gpac/gpac versions prior to the referenced fix commit. Affected processing involves input metadata containing excessively long URLs or HTML-like special characters during DASH segmentation.

Published Oct 25, 2026

Updated

Affected Software

1 affected component

Gpac MP4Box<26.07.0

Frequently Asked Questions

Who is realistically exposed to this issue?

Users or services that run MP4Box DASH segmentation on attacker-supplied or otherwise untrusted MP4 files are exposed. Exploitation requires only the ability to provide a crafted input file; no authentication or special privileges are required.

Does exploitation require a particular MP4Box operation?

The vulnerable function resolves output filename templates during DASH segmentation. The provided reproduction invokes MP4Box with the -dash option, so exposure is specifically evidenced for DASH processing of a crafted MP4.

What is the practical impact of successful exploitation?

A crafted file can cause a NULL-pointer read in strncmp(), immediately terminating the MP4Box process. The reported impact is denial of service, and no arbitrary code execution was observed.

How can I tell whether my deployment is affected?

The issue was reproducible on the current master branch at the time of discovery and affects gpac/gpac versions prior to the referenced fix commit. Affected processing involves input metadata containing excessively long URLs or HTML-like special characters during DASH segmentation.