Segmentation Violation in GPAC MP4Box via Malicious MP4 File

Executive Summary

CVE-2025-60493 is a segmentation fault vulnerability in GPAC Project/MP4Box before version 2.5. It occurs in the check_media_profile function when processing a crafted MP4 file with invalid MPEG-4 Object Descriptors. The function dereferences NULL pointers without checks, causing a crash.

Useful 0 Not Useful 0

Detection Guidance

Detect this vulnerability by monitoring for crashes in GPAC MP4Box when processing MP4 files. Use tools like gdb to trace segmentation faults in the check_media_profile function. Test with malformed MP4 files containing invalid MPEG-4 Object Descriptors to trigger the issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to cause a Denial of Service by supplying a malformed MP4 file. If exploited, it can crash the MP4Box tool, disrupting media processing tasks and potentially leading to system instability when handling such files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via segmentation fault when processing crafted MP4 files, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems. However, specific compliance impacts depend on system configuration and use case.

Useful 0 Not Useful 0

Mitigation Strategies

Update GPAC MP4Box to version 2.5 or later to apply the patch. Avoid processing untrusted MP4 files until updated. Implement input validation for media files to prevent crashes from malformed data.

Useful 0 Not Useful 0