Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2025-60495: GPAC Project/MP4Box: Denial of Service via Malformed Data File
CVE-2025-60495 · published 5 months ago
Summary
A security issue in the GPAC Project's MP4Box tool could allow an attacker to crash the program, disrupting its operation. This affects versions of MP4Box before 26.02.0. To protect your system, update to the latest version of MP4Box.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | gpac | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | gpac | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | gpac | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | gpac | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | gpac | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | gpac | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | gpac | All versions |
Original advisory text
A segmentation violation in the gf_media_get_color_info function (/media_tools/isom_tools.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying ...
A segmentation violation in the gf_media_get_color_info function (/media_tools/isom_tools.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
References
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/66/README.md URL
- https://infosec.exchange/@sigdevel/116659058320692913 URL
- https://github.com/gpac/gpac/issues/3335 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-60495 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-60495 Third Party Advisory
- https://ubuntu.com/security/CVE-2025-60495 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/06/01/13 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60495... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-60495 Vendor Advisory
- https://github.com/gpac/gpac/commit/9beed3c0a2f38505c745e5376234e7ed66e8e0b1 Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-476NULL Pointer Dereference
Timeline
Published1 Jun 2026
Updated26 Oct 2026
First seen1 Jun 2026
Sources
DEBIAN-CVE-2025-60495 · OSV
CVE-2025-60495 · NVD
UBUNTU-CVE-2025-60495 · OSV
CVE-2025-60495 · OSV
Track software like this
Free during beta