CVE-2025-60493: GPAC/MP4Box: NULL Pointer Dereference in check_media

CVE-2025-60493: GPAC/MP4Box: NULL Pointer Dereference in check_media_profile via Crafted MP4 Input

Summary by Cyber Security News25 Oct 2026, 00:29 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/377

Posted by Alexander A. Shvedov on Oct 24 Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1699-g31becc9e0-master Commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 Fixed: 9afeea23f5c6584c02aefe1e1560c2844dfb8f7e CVE: CVE-2025-60493 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L; third-party assessment) Reporter: Alexander A. Shvedov (@sigdevel) Description: MP4Box dereferences a near-NULL pointer in...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Post-Quantum Cryptography Part 2: 2030 Is Not the Deadline

The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603

A Hybrid Approach for Automated Security Pattern Recovery

PIMROP: A Feasibility Study of Return-Oriented Programming on Commercial Processing-in-Memory Architectures

Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures

CVE-2026-109518: RCE in apt(1) (DSA 6607-1)