Live › vulnerability › CVE-2025-60469
Go to dashboardGPAC's MP4Box tool, before version 2.5, dereferences a NULL pointer in gf_ac4_presentation_ch_mode when parsing an AC4 audio file. An attacker who supplies a crafted AC4 file can crash the process, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC's MP4Box on untrusted media, for example media-conversion or ingest pipelines that accept user-uploaded AC4 files. Systems that only process trusted local media, or do not use GPAC, can skip it.
No product ranges from the sources yet.
MP4Box -version and compare against 2.52.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60469")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.