PatchSiren cyber security CVE debrief
CVE-2025-60483 GPAC Project CVE debrief
A NULL pointer dereference vulnerability exists in the GPAC Project/MP4Box multimedia framework, specifically within the gf_ac4_pres_b_4_back_channels_present function in /media_tools/av_parsers.c. The flaw affects versions prior to 26.02.0 and can be triggered when processing a crafted AC4 audio file, resulting in a Denial of Service (DoS) condition. The vulnerability was addressed with a code commit that resolves the NULL pointer dereference. The issue was reported through coordinated disclosure with a proof-of-concept and public discussion.
- Vendor
- GPAC Project
- Product
- MP4Box
- CVSS
- Unknown
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-01
- Original CVE updated
- 2026-06-01
- Advisory published
- 2026-06-01
- Advisory updated
- 2026-06-01
Who should care
Organizations using GPAC/MP4Box for media processing, content delivery networks handling AC4 audio content, multimedia application developers, and security teams monitoring for parser vulnerabilities in audio processing pipelines
Technical summary
The vulnerability is a NULL pointer dereference in the gf_ac4_pres_b_4_back_channels_present function located in /media_tools/av_parsers.c within the GPAC multimedia framework. When MP4Box or libgpac processes a malformed AC4 (Dolby AC-4) audio file, the function dereferences a NULL pointer, causing a crash and resulting in Denial of Service. The issue affects GPAC versions before 26.02.0. The fix was committed to the GPAC repository, addressing the insufficient pointer validation during AC4 presentation parsing.
Defensive priority
medium
Recommended defensive actions
- Upgrade GPAC Project/MP4Box to version 26.02.0 or later to obtain the patched code
- Restrict processing of untrusted AC4 audio files until patching is complete
- Monitor for anomalous crashes in MP4Box or applications using libgpac when handling AC4 content
- Review application logs for unexpected terminations during AC4 media parsing
- Validate AC4 file inputs through sandboxed or isolated processing environments where feasible
Evidence notes
The CVE description identifies the vulnerable function and file path. The commit reference (ref-4) provides the fix. The GitHub issue (ref-5) and proof-of-concept repository (ref-6) confirm researcher disclosure. The social media post (ref-7) indicates public notification timing.
Official resources
coordinated