GPAC MP4Box BIFS NULL Pointer Dereference in StatSFVec2f Triggers Local DoS via CVE-2025-60479

A vulnerability in the open-source GPAC multimedia framework allows attackers to crash the MP4Box utility by supplying a specially crafted BIFS scene file. The issue stems from a NULL pointer dereference within the StatSFVec2f function, which processes scene graph data. According to the advisory posted on the oss-security mailing list, the flaw is rated Medium severity with a CVSS 3.1 score of 5.5. The attack requires user interaction, as the victim must open the malicious file locally.

The risk

The core issue is a lack of proper validation when processing BIFS scene data in MP4Box. When the application encounters specific structures in a crafted file, it attempts to dereference a NULL pointer, leading to an immediate crash. This results in a denial of service condition for the application. The vulnerability is classified as CWE-476. The CVSS vector indicates local access is required, with low complexity and no privileges needed, but user interaction is necessary to trigger the event.

Who is exposed

Users running the specific development build of GPAC MP4Box are exposed to this risk. The advisory identifies the affected version as 2.5-DEV-rev1678-gb7ffd9f96-master. Systems that process untrusted multimedia files using this specific build of MP4Box are vulnerable if users are tricked into opening malicious BIFS content. The flaw does not affect remote networks but relies on local file handling. Organizations using this development branch for testing or production media processing should verify their version status immediately.

Cost and compliance

The direct cost of this vulnerability is limited to application availability, as it causes crashes rather than data theft or privilege escalation. Compliance frameworks focusing on software supply chain integrity may require tracking such open-source component vulnerabilities. The CVSS score of 5.5 places this in the Medium severity range, which typically requires monitoring and timely patching but not emergency response. The advisory was posted by Alexander A. Shvedov on October 22, providing a clear timeline for awareness.

What to watch

Security teams should monitor for unexpected MP4Box process terminations when handling user-submitted media files. Check system logs for crash reports associated with the GPAC framework. Verify that internal media processing pipelines are not using the vulnerable development build. Ensure that users are not encouraged to open untrusted BIFS files without scanning.

Signals worth monitoring

Teams usually detect this type of activity by reviewing application crash logs for unhandled exceptions in the MP4Box process. Look for sudden process exits when processing new or unverified media assets. Check whether the application is running the vulnerable development version before deploying updates. Monitor for patterns where specific file types consistently trigger service interruptions. Containment moves typically involve isolating the affected processing queue and validating file integrity before further analysis.

Background: Supply chain attacks

Protect your organization by verifying software signatures, isolating third-party access, and monitoring dependencies. This checklist provides specific actions to reduce risk from compromised vendors, ensuring your security posture remains intact even when external partners fail.

Read the full guide: Supply Chain Attack Prevention Checklist for Secure Operations

What to do and how to stay safe: GPAC

• Verify the version of GPAC MP4Box installed on your systems and compare it against the affected build identifier.
• Apply the vendor-provided patch to the repository to resolve the NULL pointer dereference issue.
• Restrict the ability of users to open untrusted BIFS scene files through the MP4Box utility.
• Monitor application logs for unexpected crashes related to media processing tasks.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this GPAC MP4Box vulnerability?

The vulnerability is identified as CVE-2025-60479.

Is a fix available for this issue?

Yes, the advisory indicates that a fix has been committed to the project repository.

What is the severity rating of this flaw?

The CVSS 3.1 score is 5.5, which is rated as Medium severity.