early signals oss-security

CVE-2025-60489: NULL pointer dereference in GPAC/MP4Box dasher_insert_timeline_entry via crafted MP4 input

// summary

CVE-2025-60489 is a NULL pointer dereference in GPAC MP4Box triggered by crafted MP4 input, causing a denial of service; a fix is available.

// from the source

Posted by Alexander A. Shvedov on Oct 23 Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1692-g23819fdc0-master Commit 23819fdc02be8d3e92f0ef84831625d51981d7d2 Fixed: 4860a1a6f128ccc9ae37b4b738d22029f9672457 CVE: CVE-2025-60489 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: MP4Box dereferences a near-NULL pointer in dasher_insert_timeline_entry()...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    Ruby Regexp compilation fixes related to GitLab's CVE's

    seclists.org
  2. oss-security infra

    PHP Informational advisory: Session upload progress (CVE-2026-115560)

    seclists.org
  3. oss-security

    CVE-2026-115748: Apache Vysper: Authorization bypass

    seclists.org
  4. oss-security

    CVE-2026-115721: Apache Vysper: Unbounded allocation

    seclists.org
  5. oss-security

    CVE-2025-60497: NULL pointer dereference in GPAC/MP4Box GetESD via crafted MP4 input

    seclists.org