Cyber ·
CVE-2025-60487: NULL pointer dereference in MP4Box (GPAC) via crafted XML
Medium-severity flaw in GPAC's MP4Box: a specially crafted XML input can lead to a near-NULL pointer dereference in gf_isom_get_esd(). CVSS 3.1 score of 6.2.
The advisory, posted to the oss-sec feed on 23 October 2026, describes CVE-2025-60487 in GPAC (MP4Box). It affects the development build 2.5-DEV-rev1665-g3f20eb0cd-master, identified by commit 3f20eb0cd22116367c036e6ffe6ace299b38d686. The fix appears in commit e6d01820d7bf3967d931fedb379ee5f209bc133b. The weakness is classified as CWE-476, NULL pointer dereference. A specially crafted XML input can make MP4Box dereference a near-NULL pointer in gf_isom_get_esd(). The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, scored 6.2, rated medium; the stated impact is availability. The assessment is from BDU. To verify, confirm whether your build includes the fix commit or upgrade to a version that does. The original advisory is in the SecLists oss-sec archive, 2026, q4. The source does not name a fixed stable release, so this piece cannot say which release resolves the issue.