CYBERSECURITYTRACKER
Permanent story citation

CVE-2025-60477: GPAC/MP4Box: NULL Pointer Dereference in gf_filter_pid_resolve_file_template_ex on crafted MP4 with special metadata

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11273

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2025-60477: GPAC/MP4Box: NULL Pointer Dereference in gf_filter_pid_resolve_file_template_ex on crafted MP4 with special metadata

A NULL pointer dereference vulnerability affects GPAC (MP4Box) versions prior to a specific fix commit in the gf_filter_pid_resolve_file_template_ex function within filter_core/filter_pid.c. The flaw can be triggered by processing a crafted MP4 file with special metadata, resulting in denial of service. The CVSS 3.1 score is 4.3 (MEDIUM).

Why it matters: Organizations and developers using GPAC or MP4Box for media processing or DASH streaming workflows should update to the patched version to prevent denial of service attacks via malicious MP4 files.

CVEsCVE-2025-60477
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary