{"id":"CVE-2025-60489","kind":"vulnerability","aliases":["CVE-2025-60489"],"related":[],"title":"GPAC MP4Box: crafted MP4 file causes denial of service crash","description":"A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","summary":"GPAC's MP4Box tool dereferences a NULL pointer in its DASH timeline code when it processes a crafted MP4 file. An attacker can crash the process, causing denial of service.","severity":"low","cvss":null,"epss":0.00164,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package","self-hosted"],"not_affected_if":["gpac-2.5-or-later","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare against the fixed version `2.5`\n- Check whether MP4Box runs on untrusted input, for example in a conversion service or upload pipeline","fix":"- Upgrade GPAC to `2.5` or later\n- Until then, do not pass untrusted MP4 files to MP4Box","status":"open","published_at":"2026-10-21T14:17:07+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:15+00:00","updated_at":"2026-10-25T05:02:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:02:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC to `2.5` or later\n- Until then, do not pass untrusted MP4 files to MP4Box","reach":"unknown","title":"GPAC MP4Box: crafted MP4 file causes denial of service crash","impact":"low","summary":"GPAC's MP4Box tool dereferences a NULL pointer in its DASH timeline code when it processes a crafted MP4 file. An attacker can crash the process, causing denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker crashes MP4Box processing via a crafted file","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against the fixed version `2.5`\n- Check whether MP4Box runs on untrusted input, for example in a conversion service or upload pipeline","needs_analyst":false,"not_affected_if":["trusted-input-only","gpac-2.5-or-later"],"who_is_affected":"Teams that run GPAC's MP4Box on MP4 files they did not create, such as user uploads or media conversion pipelines. Systems that only process their own media can skip it. unknown for exact conditions beyond the affected version range.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000579,"input_tokens":3353,"output_tokens":488,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':12A,15A '-60489':13A,16A '/filters/dasher.c':67C '2.5':72C 'allow':73C 'attack':47B,74C 'caus':6A,52B,76C 'code':38B 'craft':3A,43B,85C 'crash':10A,49B 'cve':11A,14A 'dash':36B 'dasher':62C 'denial':7A,53B,78C 'derefer':30B,59C 'dos':81C 'entri':65C 'file':5A,45B,87C 'function':66C 'gpac':1A,17B,26B,69C 'host':25B 'insert':63C 'media':19B 'media-process':18B 'mp4':4A,44B,86C 'mp4box':2A,21B,28B 'null':32B,57C 'packag':22B 'pointer':33B,58C 'process':20B,41B,51B 'project/mp4box':70C 'self':24B 'self-host':23B 'servic':9A,55B,80C 'suppli':83C 'timelin':37B,64C 'tool':29B 'via':82C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC's MP4Box on MP4 files they did not create, such as user uploads or media conversion pipelines. Systems that only process their own media can skip it. unknown for exact conditions beyond the affected version range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60489","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60489","severity":null,"published_at":"2026-10-21T14:17:07+00:00","modified_at":"2026-10-23T15:17:21+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2025-60489","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-60489","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}