CVE-2025-60473: MP4Box Null Pointer DoS Vulnerability – GPAC Patching Guide

Technical summary

CVE-2025-60473 is a null pointer dereference (CWE-476) located in the gf_filter_in_parent_chain function within /filter_core/filter_pid.c of GPAC before version 26.02.0. The vulnerability arises when the filter chain initialization fails to validate pointer state before dereferencing during filter hierarchy traversal. An attacker crafting a malformed media file with specific structural properties can trigger this unhandled exception, causing immediate process termination. The attack vector is local and requires user interaction (file opening), with no privilege escalation or privilege requirement.

Business impact

Organizations using MP4Box for automated media transcoding, format conversion, or batch processing face potential service disruption. If integrated into CI/CD pipelines, media processing jobs could fail unexpectedly, delaying content delivery or breaking build processes. For media asset management systems and broadcasting workflows, this DoS condition could disrupt operational efficiency. However, impact is contained to the affected process; the vulnerability does not enable data exfiltration, privilege escalation, or lateral movement.

Affected systems

GPAC Project's MP4Box tool in versions prior to 26.02.0 is affected. This includes standalone MP4Box installations and deployments where GPAC libraries are integrated into third-party media processing applications. Users running version 26.02.0 or later are not impacted. The vulnerability does not affect other GPAC components unless they directly invoke the vulnerable filter_pid.c code path.

Exploitability

Exploitation requires minimal technical sophistication—an attacker need only craft a media file with malformed filter chain metadata and deliver it to a user or system running vulnerable MP4Box. No network access, authentication, or special privileges are required. However, successful exploitation depends on user action (opening the file), limiting opportunistic exploitation. The low attack complexity and local vector make this suitable for targeted DoS campaigns against known MP4Box deployments, but widespread exploitation remains unlikely without active distribution of malicious files.

Remediation

Upgrade GPAC Project to version 26.02.0 or later. For organizations unable to patch immediately, implement input validation by restricting MP4Box to processing media from trusted sources only. Isolate media processing systems on segmented networks to contain potential DoS impact. Monitor for unexpected MP4Box process terminations and correlate with file ingestion events to detect exploitation attempts.

Patch guidance

Verify your GPAC version by running `mp4box -version` (or equivalent for your installation method). If the version is below 26.02.0, obtain the patched release from the official GPAC Project repository or your package manager. Test the patched version in a non-production environment with your typical media workflows before full deployment to ensure compatibility. Vendor advisories confirm that version 26.02.0 and later contain the necessary null pointer validation fix.

Detection guidance

Monitor for unexpected MP4Box crashes with segmentation faults or null pointer exceptions in filter_pid.c. Enable application logging if available to capture error signatures. In automated environments, alert on process exit codes indicating abnormal termination when processing media files. If available, use static analysis or fuzzing tools to identify other potential null pointer issues in media parsing code. Log file access patterns to correlate suspicious media files with application crashes.

Why prioritize this

This vulnerability warrants prompt but not emergency patching. While the CVSS score of 5.5 (MEDIUM) reflects availability impact only, organizations with media processing dependencies should treat this as a near-term priority. The ease of triggering (crafted file delivery) and potential for operational disruption in media workflows justify accelerated remediation, particularly for broadcasting, streaming, and transcoding services. The lack of KEV designation and absence of active exploitation reports suggest this remains a low-profile issue, allowing time for staged rollout.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a local attack vector (AV:L), low attack complexity (AC:L), no privilege requirement (PR:N), and user interaction necessary (UI:R). Confidentiality and integrity are unaffected (C:N/I:N), but availability suffers high impact (A:H) due to process termination. The score appropriately captures that this is a denial-of-service condition with low barrier to triggering but no systemic or data compromise risk. For critical media infrastructure, operational risk may exceed the numeric score.

Frequently asked questions