Cyber ·
CVE-2025-60479: NULL pointer in GPAC/MP4Box via crafted BIFS scene
Security advisory on a NULL pointer dereference in GPAC/MP4Box, triggered by a specially crafted BIFS scene. CVSS 3.1 score of 5.5, medium severity, with a fix indicated by the project.
Facts from the advisory published on October 22 on the oss-sec list: the flaw is CVE-2025-60479, classified as CWE-476 (NULL pointer dereference). It affects the MP4Box tool of the GPAC project in version 2.5-DEV-rev1678-gb7ffd9f96-master, identified by commit b7ffd9f96bc188dde148300d8c4e510b557563aa. The indicated fix is commit 75786eb61b7cc838b57c3d4f8004b4f13b5b724c. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5, rated medium in the BDU assessment. According to the advisory, a specially crafted BIFS scene can trigger the failure, with availability impact. For MP4Box users, the practical step is to check the installed version and apply the project's fix. The relevance to Rota Nacional is indirect: the platform does not run or fix GPAC and does not address this vulnerability. Consult the original advisory on the oss-sec list and the official GPAC repository to confirm the details.