CVE-2025-60497

Awaiting Analysis Awaiting Analysis - Queue

Segmentation Violation in GPAC MP4Box via Malformed MP4 File

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: MITRE

Description

A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2025-60497

EUVD

EUVD-2025-211163

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

CVE-2025-60497 is a segmentation fault vulnerability in GPAC's MP4Box tool. It occurs in the GetESD function within the isomedia/track.c file when processing a maliciously crafted MP4 file. The issue involves a null pointer dereference triggered by an invalid sample description entry, such as a corrupted avC9 atom instead of a valid avcC atom. This causes the application to crash during parsing of the file.

Detection Guidance

To detect this vulnerability, monitor for crashes in MP4Box when processing MP4 files. Use tools like AddressSanitizer to identify segmentation faults during file parsing. Check for null pointer dereferences in the GetESD function by analyzing crash logs or core dumps from MP4Box processes handling malformed MP4 files.

Impact Analysis

This vulnerability allows attackers to cause a Denial of Service (DoS) by supplying a specially crafted MP4 file. If you process such files using GPAC MP4Box before version 2.5, the application will crash, potentially disrupting media processing workflows or services relying on this tool.

Compliance Impact

This vulnerability, a segmentation fault in GPAC MP4Box, primarily causes Denial of Service (DoS) by crashing the application when processing malformed MP4 files. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR or HIPAA compliance. However, repeated DoS incidents could disrupt systems processing sensitive media data, potentially leading to compliance gaps if critical services are unavailable.

Mitigation Strategies

Immediately update GPAC/MP4Box to version 2.5 or later to apply the fix for the null pointer dereference in the GetESD function. Avoid processing untrusted MP4 files until the update is applied. Implement file validation checks before processing MP4 files to detect malformed structures.

Hi! I’m here to help you understand CVE-2025-60497. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...