CVE-2025-60489 GPAC Project CVE debrief

Who should care

Defenders responsible for systems using GPAC Project/MP4Box should assess exposure and verify the version in use. This includes operators, security teams, and vulnerability management teams. Defenders should review the official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2025-60489 is a NULL pointer dereference vulnerability in GPAC Project/MP4Box before 2.5, allowing for potential Denial of Service (DoS) via crafted MP4 files. Defenders should verify the version in use and assess exposure.

• Potential Denial of Service (DoS) via crafted MP4 files
• Need to verify GPAC Project/MP4Box version and exposure

Technical summary

The dasher_insert_timeline_entry function in GPAC Project/MP4Box before 2.5 is vulnerable to a NULL pointer dereference. This can be exploited by supplying a crafted MP4 file, potentially leading to a Denial of Service (DoS). The vulnerability is caused by a lack of proper validation of the timeline entry, leading to a NULL pointer dereference. The vulnerability has a high impact on the system's availability, and defenders should prioritize verifying the version of GPAC Project/MP4Box in use and assessing exposure to crafted MP4 files.

Defensive priority

Defenders should prioritize verifying the version of GPAC Project/MP4Box in use and assessing exposure to crafted MP4 files.

Recommended defensive actions

• Verify the version of GPAC Project/MP4Box in use
• Assess exposure to crafted MP4 files
• Consider upgrading to version 2.5 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide information on the vulnerability, but details on affected versions and potential exploitation are limited. The vulnerability is confirmed to exist in GPAC Project/MP4Box before version 2.5. Defenders should verify the version in use and assess exposure to crafted MP4 files. The source item and CVE record provide limited information on the vulnerability, and defenders should review the official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.