CVE-2025-60483
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A NULL pointer dereference in GPAC Project/MP4Box before 26.02.0 in the gf_ac4_pres_b_4_back_channels_present function allows attackers to cause a Denial of Service (DoS) via a crafted AC4 file.
Risk Assessment
The organization is at risk of DoS attacks that can disrupt applications using GPAC/MP4Box, leading to service outages.
Recommendation
Update GPAC Project/MP4Box to version 26.02.0 or later.
Other vulnerabilities in GPAC Project/MP4Box
See all- CVE-2025-60485Medium
A segmentation violation in GPAC Project/MP4Box before 26.02.0 in the gf_isom_apple_set_tag_ex function allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
- CVE-2025-60481Medium
A NULL pointer dereference in GPAC Project/MP4Box before 26.02.0 in the gf_odf_ac4_cfg_dsi_v1 function allows attackers to cause a Denial of Service (DoS) via a crafted AC4 file.
Original NVD description (English source)
A NULL pointer dereference in the gf_ac4_pres_b_4_back_channels_present function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.