PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-60495 GPAC Project CVE debrief

A segmentation violation in the gf_media_get_color_info function within /media_tools/isom_tools.c of GPAC Project/MP4Box before version 26.02.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted data file. The vulnerability was addressed in a commit to the GPAC repository.

Vendor
GPAC Project
Product
MP4Box
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations using GPAC Project/MP4Box for media file processing, particularly in automated or user-facing workflows, should prioritize patching to prevent service disruption from maliciously crafted media files.

Technical summary

The vulnerability exists in the gf_media_get_color_info function located in /media_tools/isom_tools.c within the GPAC multimedia framework. When MP4Box processes a specially crafted media file, a segmentation violation occurs, resulting in a denial of service condition. The issue affects all versions prior to 26.02.0. The fix was implemented in commit 9beed3c0a2f38505c745e5376234e7ed66e8e0b1.

Defensive priority

medium

Recommended defensive actions

  • Upgrade GPAC Project/MP4Box to version 26.02.0 or later.
  • Apply the referenced commit patch if upgrading is not immediately feasible.
  • Validate and sanitize media files before processing with MP4Box, particularly files from untrusted sources.
  • Monitor for anomalous crashes in MP4Box processes as potential indicators of exploitation attempts.

Evidence notes

The CVE description identifies the vulnerable function and file path. A commit reference is available that appears to contain the fix. An issue report and proof-of-concept documentation are also referenced in the source data.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-60495 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-60495

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-60495 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-60495

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.