Cyber ·
CVE-2025-60469: NULL pointer in the AC-4 parser of GPAC/MP4Box
A NULL pointer dereference (CWE-476) in the AC-4 parser of MP4Box, triggered by a specially crafted file. CVSS 3.1 score of 5.5, medium severity, published on the oss-sec list on October 22.
The advisory describes CVE-2025-60469, a NULL pointer dereference (CWE-476) in the AC-4 format parser of MP4Box, part of the GPAC project. According to the text, a specially crafted file can make the program dereference a null or invalid pointer. The CVSS 3.1 score is 5.5, rated medium, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. In practical terms, the attack is local, requires user interaction, and the stated impact falls on availability. The affected version listed is 2.5-DEV-rev1593-gfe88c3545-master, and the fix appears in commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b. The assessment cited is from BDU. The advisory was published on the oss-sec list on October 22, and the source text is an automatic translation of the original. To verify, consult the original named by the source on the oss-sec list, compare the installed version with the affected one, and check whether the binary contains the fix commit or a later GPAC release.