CVE-2025-60477: MP4Box NULL Pointer Dereference Denial of Service

Technical summary

A NULL pointer dereference exists in the gf_filter_pid_resolve_file_template_ex function within GPAC's filter_pid.c component. When MP4Box processes a maliciously crafted media file, the function fails to validate a pointer before dereferencing it, causing an immediate null pointer exception. The vulnerability requires local file system access and user interaction to trigger, as an authenticated user must invoke MP4Box with the hostile file. Versions prior to 26.02.0 are affected.

Business impact

Organizations relying on automated or manual MP4Box workflows for video transcoding, format conversion, or media processing face service disruption. A threat actor with file upload privileges could repeatedly crash processing pipelines, creating a denial-of-service condition. Media production environments, content delivery networks, and broadcast automation systems are at risk if they integrate MP4Box without input validation or sandboxing. The impact is availability-focused: no data exfiltration or system compromise occurs, but productivity losses accumulate if reprocessing queues are blocked.

Affected systems

GPAC Project's MP4Box tool in versions before 26.02.0 is vulnerable. The flaw is in the core filter framework, so any deployment using gf_filter_pid_resolve_file_template_ex is exposed. End users running MP4Box on Linux, macOS, or Windows systems for multimedia workflows are affected. Systems that expose MP4Box as a service to untrusted file sources (e.g., web upload forms) face elevated risk. No other GPAC utilities or third-party products are directly implicated by this CVE.

Exploitability

Exploitability is moderate in opportunistic scenarios but low in well-defended environments. An attacker must either upload a crafted file to a system running MP4Box or convince an authenticated user to open one. The attack requires no special privileges beyond basic file system access and user-level execution. Automation pipelines that process user-supplied media without validation present the easiest attack surface. However, the vulnerability cannot be exploited remotely, does not require user code execution, and does not grant escalated privileges—limiting its strategic value compared to remote code execution flaws.

Remediation

Upgrade GPAC/MP4Box to version 26.02.0 or later. Patch availability can be verified through the GPAC project's official repository or release notes. Until patching is complete, implement compensating controls: validate and sanitize input files before processing, run MP4Box in isolated containers or virtual environments, restrict file upload permissions, and monitor for unexpected process crashes in media pipelines. Organizations should prioritize patching in development and testing environments first to confirm workflow compatibility.

Patch guidance

Check the GPAC Project's official GitHub repository and release notes for version 26.02.0 availability and installation instructions for your operating system. The project maintains builds for Windows, macOS, and Linux. Verify against the vendor advisory that the patch addresses CVE-2025-60477 specifically. Test patches in a staging environment with representative media files to ensure no regression in encoding or transcoding quality. Deploy via your standard software update process or package manager if MP4Box is installed that way.

Detection guidance

Monitor logs for unexpected crashes or segmentation faults in MP4Box processes, particularly those correlating with specific input files. Watch for repeated process restarts or service unavailability in media processing pipelines. Endpoint detection and response (EDR) tools can flag abnormal process termination patterns. File integrity monitoring on media libraries may reveal unusual file characteristics preceding crashes. Log aggregation systems should alert on error codes or stack traces mentioning gf_filter_pid_resolve_file_template_ex or NULL pointer exceptions. In containerized environments, track container restart events linked to MP4Box operations.

Why prioritize this

This vulnerability merits medium priority in most environments because it enables denial of service without data breach or privilege escalation. However, organizations operating media processing infrastructure—particularly those accepting untrusted uploads—should prioritize it higher. The low CVSS score (5.0) reflects the limited impact scope, but operational cost of downtime may justify faster patching in mission-critical contexts. The requirement for local access and user interaction naturally limits blast radius compared to network-exploitable flaws.

Risk score, explained

The CVSS 3.1 score of 5.0 (MEDIUM) reflects a flaw with local attack vector, low complexity, and low privilege requirement, but high availability impact and no confidentiality or integrity loss. The score appropriately captures that this is a localized denial-of-service vector with no direct path to data compromise or system takeover. Risk may be elevated internally based on organizational dependency on MP4Box uptime and the frequency of untrusted file processing.

Frequently asked questions