PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-60481 GPAC Project CVE debrief

A NULL pointer dereference vulnerability exists in the gf_odf_ac4_cfg_dsi_v1 function within /odf/descriptors.c in GPAC Project/MP4Box versions prior to 26.02.0. The flaw can be triggered when processing a crafted AC4 audio file, resulting in a Denial of Service (DoS) condition. The vulnerability was addressed in a commit to the GPAC repository.

Vendor
GPAC Project
Product
MP4Box
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations using GPAC/MP4Box for media processing, particularly those handling AC4 audio files from untrusted sources, should prioritize patching.

Technical summary

The vulnerability is a NULL pointer dereference located in the gf_odf_ac4_cfg_dsi_v1 function in /odf/descriptors.c. When MP4Box or other GPAC-based tools process a malformed AC4 audio file, the dereference causes a crash, leading to Denial of Service. The issue affects versions before 26.02.0.

Defensive priority

medium

Recommended defensive actions

  • Upgrade GPAC Project/MP4Box to version 26.02.0 or later to obtain the fix for this vulnerability.
  • Restrict processing of untrusted AC4 audio files until patching is complete.
  • Monitor for anomalous crashes in MP4Box or applications using libgpac when handling AC4 content.

Evidence notes

The CVE description identifies the affected function and file path. A commit reference indicates a fix was applied. An issue report and proof-of-concept documentation are also cited in source references.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-60481 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-60481

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-60481 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-60481

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.