Live › vulnerability › CVE-2025-60489
Go to dashboardGPAC's MP4Box tool dereferences a NULL pointer in its DASH timeline code when it processes a crafted MP4 file. An attacker can crash the process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC's MP4Box on MP4 files they did not create, such as user uploads or media conversion pipelines. Systems that only process their own media can skip it. unknown for exact conditions beyond the affected version range.
No product ranges from the sources yet.
MP4Box -version and compare against the fixed version 2.52.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60489")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.