CVE-2025-60495: MP4Box Segmentation Fault DoS Vulnerability – Patching Guide

Technical summary

CVE-2025-60495 is a null pointer dereference (CWE-476) in the gf_media_get_color_info function within /media_tools/isom_tools.c of GPAC Project/MP4Box versions prior to 26.02.0. The vulnerability manifests as a segmentation violation when the function processes color metadata from an ISO Base Media File Format (MP4) file without proper bounds or validity checking. An attacker-supplied crafted MP4 or similar container file containing malformed color information structures can dereference invalid memory, terminating the process. The issue is triggered during file parsing, making it reachable via any code path that invokes color metadata extraction.

Business impact

This vulnerability primarily affects availability. Organizations relying on MP4Box for automated media transcoding, ingestion, content delivery pipelines, or media analysis workflows face service interruptions if a single malicious file causes a crash. In high-volume or continuous processing environments—such as streaming platforms, broadcast facilities, or media storage appliances—an attacker could selectively target batch jobs or real-time workflows. The attack surface is proportional to how widely a system accepts untrusted media files from external sources. For most enterprises, impact is moderate unless MP4Box is core to a user-facing or production pipeline.

Affected systems

GPAC Project/MP4Box versions below 26.02.0 are vulnerable. MP4Box is commonly embedded in open-source and commercial media frameworks, transcoding solutions, and content management systems. The vulnerability affects any deployment processing media files from untrusted sources—including web applications accepting user uploads, media archives processing external submissions, and automation systems handling third-party content. Organizations using patched versions (26.02.0 and later) are not affected. Verify your specific version and integration points to assess exposure.

Exploitability

Exploitation requires local file system access or the ability to supply a crafted media file to a system running the vulnerable MP4Box version. There is no network attack vector; the vulnerability cannot be triggered remotely unless the target system exposes a service that accepts and processes media files (e.g., a web application). User interaction is necessary—someone must initiate file processing. Attack complexity is low; creating a malformed MP4 file is straightforward and does not require specialized knowledge. Once delivered, exploitation is reliable and causes immediate denial of service. This is not included in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread active exploitation has been observed as of the publication date.

Remediation

Upgrade GPAC Project/MP4Box to version 26.02.0 or later. This patch addresses the null pointer dereference in the color information parsing function. For organizations unable to upgrade immediately, implement input validation and file filtering to reject or quarantine suspicious media files. Consider running MP4Box processes with reduced privileges, in containers, or sandboxed environments to limit damage from process crashes. Monitor logs for segmentation faults or unexpected MP4Box terminations as indicators of exploitation attempts.

Patch guidance

Apply the GPAC Project/MP4Box update to version 26.02.0 or later as soon as possible in your development and production environments. Verify the patch through the official GPAC repository or your distribution vendor. Test the patch in a non-production environment first to ensure compatibility with your specific media workflows and integrations. If MP4Box is vendored or embedded in a commercial product, check with your vendor for a patched release; patching timelines may differ.

Detection guidance

Monitor for segmentation faults (SIGSEGV) or abnormal terminations of MP4Box processes, particularly those handling media files from untrusted sources. Implement file integrity and reputation checks to identify malicious or anomalous media files before processing. Review access logs for attempts to upload or submit media files to systems running older MP4Box versions. In automated environments, log the exit codes and error messages of media processing tasks; a crash with a segmentation violation may indicate exploitation. Network-based detection is limited; focus on endpoint and application-level monitoring.

Why prioritize this

Although CVSS rates this as MEDIUM (5.5), prioritize patching based on your media processing footprint. If MP4Box is used in production transcoding, web uploads, or content pipelines, the impact of unexpected service restarts can be significant. The attack surface depends on whether your systems accept media from untrusted sources; if they do, this should be addressed promptly. The fix is straightforward and low-risk, making this an ideal candidate for early patching. Organizations with isolated or offline MP4Box deployments may deprioritize but should still plan an update cycle.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector, low complexity, and high impact on availability with no confidentiality or integrity concerns. The presence of user interaction (file opening) prevents a higher score. In real-world context, risk is elevated for organizations processing high volumes of external media; the actual risk to your organization depends on your specific workflows and trust boundaries around media file sources.

Frequently asked questions