PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-60483 GPAC Project CVE debrief

A NULL pointer dereference vulnerability exists in the GPAC Project/MP4Box multimedia framework, specifically within the gf_ac4_pres_b_4_back_channels_present function in /media_tools/av_parsers.c. The flaw affects versions prior to 26.02.0 and can be triggered when processing a crafted AC4 audio file, resulting in a Denial of Service (DoS) condition. The vulnerability was addressed with a code commit that resolves the NULL pointer dereference. The issue was reported through coordinated disclosure with a proof-of-concept and public discussion.

Vendor
GPAC Project
Product
MP4Box
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations using GPAC/MP4Box for media processing, content delivery networks handling AC4 audio content, multimedia application developers, and security teams monitoring for parser vulnerabilities in audio processing pipelines

Technical summary

The vulnerability is a NULL pointer dereference in the gf_ac4_pres_b_4_back_channels_present function located in /media_tools/av_parsers.c within the GPAC multimedia framework. When MP4Box or libgpac processes a malformed AC4 (Dolby AC-4) audio file, the function dereferences a NULL pointer, causing a crash and resulting in Denial of Service. The issue affects GPAC versions before 26.02.0. The fix was committed to the GPAC repository, addressing the insufficient pointer validation during AC4 presentation parsing.

Defensive priority

medium

Recommended defensive actions

  • Upgrade GPAC Project/MP4Box to version 26.02.0 or later to obtain the patched code
  • Restrict processing of untrusted AC4 audio files until patching is complete
  • Monitor for anomalous crashes in MP4Box or applications using libgpac when handling AC4 content
  • Review application logs for unexpected terminations during AC4 media parsing
  • Validate AC4 file inputs through sandboxed or isolated processing environments where feasible

Evidence notes

The CVE description identifies the vulnerable function and file path. The commit reference (ref-4) provides the fix. The GitHub issue (ref-5) and proof-of-concept repository (ref-6) confirm researcher disclosure. The social media post (ref-7) indicates public notification timing.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-60483 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-60483

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-60483 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-60483

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.