PatchSiren cyber security CVE debrief
CVE-2025-60481 GPAC Project CVE debrief
A NULL pointer dereference vulnerability exists in the gf_odf_ac4_cfg_dsi_v1 function within /odf/descriptors.c in GPAC Project/MP4Box versions prior to 26.02.0. The flaw can be triggered when processing a crafted AC4 audio file, resulting in a Denial of Service (DoS) condition. The vulnerability was addressed in a commit to the GPAC repository.
- Vendor
- GPAC Project
- Product
- MP4Box
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-01
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-06-01
- Advisory updated
- 2026-07-22
Who should care
Organizations using GPAC/MP4Box for media processing, particularly those handling AC4 audio files from untrusted sources, should prioritize patching.
Technical summary
The vulnerability is a NULL pointer dereference located in the gf_odf_ac4_cfg_dsi_v1 function in /odf/descriptors.c. When MP4Box or other GPAC-based tools process a malformed AC4 audio file, the dereference causes a crash, leading to Denial of Service. The issue affects versions before 26.02.0.
Defensive priority
medium
Recommended defensive actions
- Upgrade GPAC Project/MP4Box to version 26.02.0 or later to obtain the fix for this vulnerability.
- Restrict processing of untrusted AC4 audio files until patching is complete.
- Monitor for anomalous crashes in MP4Box or applications using libgpac when handling AC4 content.
Evidence notes
The CVE description identifies the affected function and file path. A commit reference indicates a fix was applied. An issue report and proof-of-concept documentation are also cited in source references.
Sources and references
Verified primary and authoritative sources
-
CVE-2025-60481 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2025-60481
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2025-60481 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2025-60481
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b
-
Source reference
Unverified legacy reference
URL: https://github.com/gpac/gpac/issues/3296
-
Source reference
Unverified legacy reference
URL: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/45/README.md
-
Source reference
Unverified legacy reference
URL: https://infosec.exchange/@sigdevel/116659159345966316
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.