NULL Pointer Dereference in GPAC MP4Box via Malicious AC4 File

Executive Summary

CVE-2025-60469 is a NULL pointer dereference vulnerability in the GPAC Project's MP4Box tool. It occurs in the gf_ac4_presentation_ch_mode function within the av_parsers.c file. When processing a maliciously crafted AC4 audio file with unsupported presentation versions or missing substream groups, the parser fails to handle error conditions properly. This leads to a segmentation fault due to reading a null memory address, causing a Denial of Service (DoS).

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires analyzing GPAC/MP4Box processing of AC-4 audio files. Use AddressSanitizer or Valgrind to monitor for null pointer dereferences during media file parsing. Test with malformed AC-4 files containing unsupported presentation versions or missing substream groups to trigger crashes.

Useful 0 Not Useful 0

Impact Analysis

If you process AC4 audio files using GPAC's MP4Box tool, an attacker could exploit this vulnerability by providing a specially crafted file. This would crash the application, leading to a DoS. The impact is limited to the availability of the MP4Box tool during processing of the malicious file.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via NULL pointer dereference in media processing, which could disrupt system availability. While not directly impacting GDPR or HIPAA compliance, such DoS conditions may affect service continuity required by these regulations for data processing and access.

Useful 0 Not Useful 0

Mitigation Strategies

Update GPAC to version 2.5 or later to apply the fix in commit e02d1fd. Avoid processing untrusted AC-4 files until patched. Implement input validation for media files and monitor for crashes during parsing as a detection measure.

Useful 0 Not Useful 0