{"id":"CVE-2025-60479","kind":"vulnerability","aliases":["CVE-2025-60479"],"related":[],"title":"GPAC MP4Box: crafted MPEG-4 file crashes the tool with a NULL dereference","description":"A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.","summary":"GPAC's MP4Box tool dereferences a NULL pointer in StatSFVec2f when parsing a crafted MPEG-4 file, before version 2.5. An attacker who supplies such a file can crash the process, causing denial of service.","severity":"low","cvss":null,"epss":0.00164,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package"],"not_affected_if":["trusted-input-only","version-2.5-or-later"],"how_to_check":"- Run `MP4Box -version` and compare against `2.5`\n- Check whether MP4Box processes untrusted MP4 files in any pipeline or service","fix":"- Upgrade GPAC MP4Box to `2.5` or later\n- Until then, do not feed it untrusted MPEG-4 files","status":"open","published_at":"2026-10-21T14:17:06+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:15+00:00","updated_at":"2026-10-25T05:02:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:02:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC MP4Box to `2.5` or later\n- Until then, do not feed it untrusted MPEG-4 files","reach":"unknown","title":"GPAC MP4Box: crafted MPEG-4 file crashes the tool with a NULL dereference","impact":"low","summary":"GPAC's MP4Box tool dereferences a NULL pointer in StatSFVec2f when parsing a crafted MPEG-4 file, before version 2.5. An attacker who supplies such a file can crash the process, causing denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing"],"confidence":0.6,"needs_auth":"no","worst_case":"Crash of the MP4Box process causing denial of service","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against `2.5`\n- Check whether MP4Box processes untrusted MP4 files in any pipeline or service","needs_analyst":false,"not_affected_if":["version-2.5-or-later","trusted-input-only"],"who_is_affected":"Teams that run GPAC MP4Box on a version before 2.5 against files they do not fully control, such as user uploads or media from external sources. Systems that only process trusted local media are at much lower risk. The sources do not describe further configuration requirements.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000586,"input_tokens":3357,"output_tokens":501,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':15A,18A '-4':5A,41B,89C '-60479':16A,19A '/scene_manager/scene_stats.c':69C '2.5':45B,74C 'allow':75C 'attack':47B,76C 'caus':57B,78C 'craft':3A,39B,87C 'crash':7A,54B 'cve':14A,17A 'denial':58B,80C 'derefer':13A,30B,64C 'dos':83C 'file':6A,42B,52B,90C 'function':68C 'gpac':1A,20B,26B,71C 'media':22B 'media-process':21B 'mp4box':2A,24B,28B 'mpeg':4A,40B,88C 'null':12A,32B,62C 'packag':25B 'pars':37B 'pointer':33B,63C 'process':23B,56B 'project/mp4box':72C 'servic':60B,82C 'statsfvec2f':35B,67C 'suppli':49B,85C 'tool':9A,29B 'version':44B 'via':84C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC MP4Box on a version before 2.5 against files they do not fully control, such as user uploads or media from external sources. Systems that only process trusted local media are at much lower risk. The sources do not describe further configuration requirements.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60479","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60479","severity":null,"published_at":"2026-10-21T14:17:06+00:00","modified_at":"2026-10-22T21:17:13+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2025-60479","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-60479","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}