CYBERSECURITYTRACKER
Permanent story citation

CVE-2025-60479: NULL pointer dereference in GPAC/MP4Box StatSFVec2f via crafted BIFS scene

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11130

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2025-60479: NULL pointer dereference in GPAC/MP4Box StatSFVec2f via crafted BIFS scene

A NULL pointer dereference vulnerability exists in GPAC's MP4Box component when processing crafted BIFS scene files. The flaw affects version 2.5-DEV and was resolved in commit 75786eb.

Why it matters: Practitioners using GPAC to process untrusted MP4 or BIFS files face denial of service risk; verify whether your deployment includes the patched commit.

CVEsCVE-2025-60479
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary