Cyber ·
CVE-2025-60497: NULL pointer dereference in GetESD of GPAC/MP4Box via crafted MP4 input
Security advisory on a NULL pointer dereference in the GetESD function of MP4Box (GPAC), triggered by a specially crafted MP4 input. Severity is medium, with CVSS 3.1 score 5.5, per the assessment cited in the source.
The advisory describes CVE-2025-60497, classified as CWE-476 (NULL pointer dereference). According to the source, a specially crafted MP4 input can trigger the flaw in GetESD() in MP4Box, a tool from the GPAC project. Severity is medium. The CVSS 3.1 score is 5.5, with vector AV:L, AC:L, PR:N, UI:R, S:U, C:N, I:N, A:H, and the assessment is attributed to CISA in the source. The stated impact is availability (A:H), with no confidentiality or integrity impact declared. The local attack vector and the need for user interaction reduce exposure, since the file must be processed locally. The affected version given is 2.5-DEV-rev1780-g50b5741f2-master, at commit 50b5741f291126b610c59db433fc02e8a17f0c5d. The fix appears in commit 91083fcfce01aa596a13a6962768d13a60bfc8bb. The report was published on 23 October 2026 on the oss-sec list, with machine translation provided by the source. To verify, consult the original oss-sec 2026 posting at the address given in the original source, and confirm in the official GPAC repository the commits listed and the fixed version you use.