CVE-2025-60477: GPAC/MP4Box: NULL Pointer Dereference in gf_filter_pid_resolve_file_template

CVE-2025-60477: GPAC/MP4Box: NULL Pointer Dereference in gf_filter_pid_resolve_file_template_ex on crafted MP4 with special metadata

Reported by oss-security

Summary by Cyber Security News26 Oct 2026, 01:10 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/378

Posted by Alexander A. Shvedov on Oct 25 Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60477 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel Description: The gf_filter_pid_resolve_file_template_ex function in filter_core/filter_pid.c is responsible for resolving output file name templates during DASH...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Node.js security release pre-alert

Open-source file sync tool rsync 3.5.2 fixes a CPU exhaustion flaw

Ghostunnel: Open-source TLS proxy with mutual authentication

Rails security releases: 8.0.5.2 and 8.1.4.1

Fixed Detectors, Moving Code: How Well Do Static Security Analyzers Hold Up over a Decade of C/C++ Evolution?

When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation