GPAC MP4Box Patch Fixes NULL Pointer Dereference in BIFS Scene Parsing

Alexander A. Shvedov reported a NULL pointer dereference vulnerability in GPAC/MP4Box, assigned CVE-2025-60479. The flaw allows a local attacker to crash the application by processing a crafted BIFS scene.

What happened

The vulnerability exists in the StatSFVec2f function within the GPAC media framework and its MP4Box utility. According to the advisory posted on the oss-security mailing list, the issue affects version 2.5-DEV-rev1678-gb7ffd9f96-master. The flaw is classified as a NULL pointer dereference, corresponding to CWE-476.

An attacker can trigger this crash by supplying a specifically crafted BIFS scene to the application. The Common Vulnerability Scoring System version 3.1 rates this flaw as 5.5, which is considered medium severity. The vector string indicates local access is required, with no privileges needed but user interaction necessary.

The impact is limited to high availability loss, with no compromise of confidentiality or integrity. The reporter, Alexander A. Shvedov, documented the issue on October 22. The advisory confirms that the vulnerability has been addressed in the codebase.

Why it matters

For organizations using GPAC or MP4Box for media processing, this flaw represents a denial-of-service risk. While the CVSS score is medium, any application crash can disrupt workflows or services relying on these tools. The requirement for user interaction mitigates the risk slightly, as an attacker cannot exploit this remotely without some form of user engagement.

The fact that the vulnerability exists in a development version suggests that users testing pre-release builds are most at risk. Production environments running stable releases may not be affected, but teams must verify their specific versions against the affected identifier.

What to watch

• Monitor official GPAC release channels for stable updates containing the fix
• Review logs for unexpected MP4Box crashes or termination events
• Verify that development versions are not deployed in production environments
• Check input validation procedures for media files processed by these tools

Who needs to act first

Teams should prioritize updating any systems running the specific development version identified in the advisory. Since the flaw requires local access, focus on environments where untrusted media files are processed. Apply the patch in a test environment first to ensure compatibility with existing workflows. Back up configuration files and media projects before applying changes. If the specific development version is not in use, audit other media processing tools for similar parsing vulnerabilities.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: GPAC

• Verify the exact version of GPAC/MP4Box installed on all systems
• Apply the latest available update from the official vendor repository
• Restrict access to media processing tools to authorized users only
• Validate media files for integrity before processing them

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which version of GPAC is affected by CVE-2025-60479?

Version 2.5-DEV-rev1678-gb7ffd9f96-master is affected by this vulnerability.

Is there a fix available for this vulnerability?

Yes, a fix has been committed to the codebase, identified by commit 75786eb61b7cc838b57c3d4f8004b4f13b5b724c.

What is the severity of this vulnerability?

The CVSS 3.1 score is 5.5, which is rated as medium severity.