NULL Pointer Dereference Vulnerability in GPAC Project's MP4Box Software
CVE-2025-60473

5.5MEDIUM

Key Information:

Vendor

GPAC Project

Status
MP4Box
Vendor
CVE Published:
24 June 2026

What is CVE-2025-60473?

A vulnerability exists in the gf_filter_in_parent_chain function of GPAC Project's MP4Box software, specifically related to a NULL pointer dereference. This flaw allows attackers to exploit the software by supplying specially crafted files, which can lead to a Denial of Service (DoS) condition. Users of the affected versions are advised to update to the latest release to mitigate this security risk.

References

https://github.com/gpac/gpac/issues/3285
https://github.com/gpac/gpac/commit/b8d80b44718de10b101e1...
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Bo...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.