CYBERSECURITYTRACKER
Permanent story citation

CVE-2025-60494: invalid memory read in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11188

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2025-60494: invalid memory read in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input

CVE-2025-60494 is a NULL pointer dereference vulnerability in GPAC's MP4Box tool that occurs during an invalid memory read in the gf_props_equal_internal function when processing crafted MP4 files. The flaw affects GPAC 2.5-DEV and was fixed in commit fcb9083292befe61d3e2466b18edfedba49da098. An attacker can trigger the vulnerability through a malicious MP4 input file to cause a denial of service.

Why it matters: Organizations and developers using GPAC MP4Box for media processing face denial of service risk if they process untrusted MP4 files; apply the fix commit or update when a patched release is available.

CVEsCVE-2025-60494
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary