NULL Pointer Dereference in GPAC MP4Box via Crafted MPEG-4 File

Executive Summary

CVE-2025-60479 is a NULL pointer dereference vulnerability in the GPAC Project's MP4Box software. It occurs in the StatSFVec2f function within the scene_stats.c file. When processing crafted MPEG-4 files with broken vector fields, the function fails to validate pointers before accessing memory, causing a crash (segmentation fault). The vulnerability was fixed in commit 75786eb by adding null checks for the 'val' parameter in multiple functions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in GPAC's MP4Box when processing MPEG-4 files. Use the command 'MP4Box -nstat' on suspicious files to trigger potential null pointer dereferences. Check system logs for segmentation faults in scene_manager/scene_stats.c.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to cause a Denial of Service (DoS) by supplying a specially crafted MPEG-4 file. When processed by MP4Box, the application will crash due to the null pointer dereference, potentially disrupting media processing tasks or services relying on GPAC.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via NULL pointer dereference, leading to application crashes. Such crashes may disrupt data processing or availability, potentially violating availability requirements in standards like GDPR (Article 32) or HIPAA (Security Rule). However, the provided context does not specify direct impacts on compliance beyond service disruption.

Useful 0 Not Useful 0

Mitigation Strategies

Update GPAC to version 2.5 or later to apply the fix from commit 75786eb. Avoid processing untrusted MPEG-4 files with MP4Box until patched. Monitor for crashes in scene statistics processing as an indicator of exploitation.

Useful 0 Not Useful 0