CVE-2025-60489 in MP4Box
Summary
by MITRE • 10/21/2026
A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the GPAC Project, specifically in the MP4Box utility prior to version 2.5, stems from an improper handling of input data during the processing of multimedia container files. The core technical flaw resides in the dasher_insert_timeline_entry function located within the source file filters/dasher.c. This component is responsible for managing timeline entries when preparing media content for Dynamic Adaptive Streaming over HTTP or similar adaptive streaming protocols. When MP4Box processes a specially crafted MP4 file, it fails to adequately validate pointers before attempting to dereference them in this specific context. A NULL pointer dereference occurs when the software attempts to access memory at address zero, which is typically reserved by operating systems and inaccessible to user-space applications. This violation of memory safety principles results in an immediate termination of the process due to a segmentation fault or similar critical error signal generated by the underlying operating system kernel.
From an operational perspective, this vulnerability enables a remote attacker to cause a Denial of Service against services that rely on MP4Box for media preprocessing or conversion tasks. By supplying a maliciously constructed MP4 file containing specific malformed structures that trigger the NULL pointer condition within dasher_insert_timeline_entry, an adversary can force the application to crash unexpectedly. This disruption prevents legitimate users from accessing streaming content or utilizing the media processing capabilities of the affected system. In environments where MP4Box is used as part of a larger pipeline for video transcoding or adaptive bitrate generation, such crashes can lead to significant service interruptions, requiring manual intervention to restart services and potentially causing data loss if in-progress conversions are aborted without proper state recovery mechanisms.
The classification of this flaw aligns with Common Weakness Enumeration identifier CWE-476, which denotes a NULL Pointer Dereference. This category encompasses errors where software fails to check for null pointers before using them as valid memory addresses. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1499, specifically under the endpoint denial of service subcategory, as it involves overwhelming or crashing a specific component through malformed input rather than resource exhaustion via volume. The attack vector is classified as remote with low complexity, requiring only the delivery of the crafted file to the target system running the vulnerable version of MP4Box.
Mitigation strategies primarily involve upgrading the GPAC Project and MP4Box software to version 2.5 or later, where this specific memory safety issue has been addressed through improved input validation and pointer checks within the dasher_insert_timeline_entry function. For organizations unable to immediately patch their systems, deploying a web application firewall or media processing gateway that inspects incoming MP4 files for structural anomalies can provide an additional layer of defense. Such inspection mechanisms should be configured to reject files with malformed timeline structures or unexpected NULL references before they reach the vulnerable application component. Additionally, implementing strict input validation rules and employing fuzzing techniques during development cycles can help identify similar memory safety issues in other parts of the media processing pipeline, ensuring robust protection against exploitation attempts targeting multimedia handling software.