CVE-2025-60473: NULL Pointer Dereference in GPAC MP4Box

Vulnerability Overview Vulnerability Name: CVE-2025-60473 - NULL Pointer Dereference in GPAC MP4Box Filter Parent Chain Description: The function fails to sufficiently validate the parent filter pointer before dereferencing it when processing MP4Box media files containing malformed MPEG-2 TS data and broken PID/filter chains, resulting in a null pointer dereference and causing a denial of service. Attack Conditions: An attacker provides a media file containing malformed MPEG-2 TS packet data and broken PID/filter chains. The issue can be reproduced locally using the following command: CVSS Vector: Impact: The directly observed impact is a denial of service due to process termination. Local MITRE/BDU data also indicates the potential for arbitrary code execution, although available ASAN evidence points to a null pointer dereference crash. Scope of Impact Affected Component: function Affected Product: MP4Box (GPAC Multimedia Open Source Project) Affected Versions: The issue was reproduced in version . Vulnerable Versions Before Fix: All versions of GPAC Project/MP4Box prior to are affected. Builds prior to the fixing commit should be considered affected if they contain the vulnerable filter parent-chain validation path. Remediation Fix Status: The issue has been fixed in GPAC commit . Recommendation: Users should update to a GPAC build that includes this commit or a later version. The affected filter graph code should validate parent filter pointers before dereferencing them during PID initialization. References: - Issue: github.com/gpac/gpac/issues/32 - PoC: github.com/sigdevel/pocs/blob/... - Fix: github.com/gpac/gpac/commit/b8d80b44718de10b101e1d7fc17c84d69feb092e - CVE record: cve.org/CVERecord?id=CVE-2025-60473

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-60473: NULL Pointer Dereference in GPAC MP4Box