CVE-2025-60473

MediumCVSS 5.5

Published: 25/06/2026(UTC)Updated: 29/06/2026(UTC)Translated: 30/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile — higher than 3% of all known CVEs

Summary

A NULL pointer dereference vulnerability was found in the gf_filter_in_parent_chain function of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted file.

Risk Assessment

The risk involves potential disruption of applications using GPAC/MP4Box by sending a specially crafted file, which may lead to service unavailability.

Recommendation

It is recommended to immediately upgrade GPAC/MP4Box to version 26.02.0 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.