early signals oss-security

CVE-2025-60477: GPAC/MP4Box: NULL Pointer Dereference in gf_filter_pid_resolve_file_template_ex on crafted MP4 with special metadata

// AI summary

GPAC/MP4Box prior to the fix commit has CVE-2025-60477, a NULL Pointer Dereference in gf_filter_pid_resolve_file_template_ex when processing crafted MP4 files with special metadata.

// from the source

Posted by Alexander A. Shvedov on Oct 25 Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60477 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel https://infosec.exchange/@sigdevel Description: The gf_filter_pid_resolve_file_template_ex function in filter_core/filter_pid.c is responsible for resolving output file name templates during DASH...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

    seclists.org
  2. oss-security

    CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

    seclists.org
  3. oss-security infra

    [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)

    seclists.org
  4. oss-security infra

    [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

    seclists.org
  5. oss-security infra

    CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

    seclists.org