Live › vulnerability › CVE-2025-60479
Go to dashboardGPAC's MP4Box tool dereferences a NULL pointer in StatSFVec2f when parsing a crafted MPEG-4 file, before version 2.5. An attacker who supplies such a file can crash the process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC MP4Box on a version before 2.5 against files they do not fully control, such as user uploads or media from external sources. Systems that only process trusted local media are at much lower risk. The sources do not describe further configuration requirements.
No product ranges from the sources yet.
MP4Box -version and compare against 2.52.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60479")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.