Cyber ·
CVE-2025-60494: invalid memory read in MP4Box from GPAC
Medium-severity advisory for GPAC (MP4Box): a specially crafted MP4 input can cause an invalid memory read in gf_props_equal_internal(). The affected version and the fix commit are reported.
According to the advisory relayed through the oss-sec list, a specially crafted MP4 input can trigger an invalid memory read in the gf_props_equal_internal() function of MP4Box, part of the GPAC project. The flaw is tracked as CVE-2025-60494 and classified as CWE-476, NULL pointer dereference. The reported CVSS 3.1 score is 5.5, medium severity, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, which declares impact only on availability, local access, and required user interaction. The affected version listed is 2.5-DEV-rev1699-g31becc9e0-master, associated with commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9. The indicated fix is commit fcb9083292befe61d3e2466b18edfedba49da098. The advisory is dated October 23, 2026, and the available text is an automatic translation of the feed content; the full description is not reproduced here. To verify, find the original advisory in the 2026 oss-sec list by its CVE title and check the GPAC repository history using the hashes above.