Cyber ·
CVE-2025-60489: NULL pointer dereference in GPAC MP4Box via a specially crafted MP4 entry
Advisory from the oss-sec list dated October 23, 2026 describes a NULL pointer dereference in dasher_insert_timeline_entry in MP4Box (GPAC), classified as CWE-476, CVSS 3.1 5.5 (medium), with a fix commit published.
The advisory posted to the oss-sec list on October 23, 2026 describes CVE-2025-60489 in GPAC, product MP4Box. A specially crafted MP4 entry can cause MP4Box to dereference a pointer near NULL inside the function dasher_insert_timeline_entry(). The classification is CWE-476, NULL pointer dereference. The CVSS 3.1 score is 5.5, medium, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, meaning local access, no privileges required, user interaction required, no confidentiality or integrity impact, and high availability impact. The affected version listed is 2.5-DEV-rev1692-g23819fdc0-master, at commit 23819fdc02be8d3e92f0ef84831625d51981d7d2. The fix is at commit 4860a1a6f128ccc9ae37b4b738d22029f9672457. The advisory credits a researcher named in the original text. The text reviewed is an automatic translation of the feed, so verify against the original oss-sec advisory and the GPAC project repository history, comparing the affected commit with the fixed one.