CVE-2025-60485: NULL Pointer Dereference DoS in GPAC MP4Box

Vulnerability Overview Vulnerability Name: CVE-2025-60485 - NULL Pointer Dereference in GPAC/MP4Box Vulnerability Type: NULL Pointer Dereference Vulnerability Description: A NULL pointer dereference (reading address 0x0) is triggered in the function when processing MP4 files containing malformed "esds" boxes and incomplete box structures, causing MP4Box to crash. Impact Scope Affected Components: - - - - Affected Product: MP4Box (GPAC Multimedia Open Source Project) Affected Versions: 2.5-DEV-rev1687-ge44a4e2b0-master, commit . Any codebase equivalent to this version that has not applied the fix commit is affected. Attack Conditions: The attacker provides an MP4 file containing a malformed "esds" box (invalid descriptor size) and incomplete box structures. Local access is required; the victim must invoke or any equivalent MP4Box operation that triggers the muxer PID setting and tag writing path. Impact: A NULL pointer dereference (reading address 0x000000000000) causes the process to crash immediately, resulting in a denial of service. Arbitrary code execution was not observed; the faulty access is a NULL read and cannot be used for control flow hijacking. Remediation Fix/Mitigation Status: The fix adds a NULL check before dereferencing in . Users should upgrade to a release version containing commit or apply the patch directly. References: - Issue: github.com/gpac/gpac/issues/33... - PoC: github.com/sigdevel/pocs/blob/... - Fix: github.com/gpac/gpac/commit/48... POC Code ```c / Copyright (c) 2005-2016, Guillaume Chéreau All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #includ

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-60485: NULL Pointer Dereference DoS in GPAC MP4Box

More from this source