Description
A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
Published: 2026-06-24
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A NULL pointer dereference in the gf_filter_in_parent_chain function of GPAC Project/MP4Box before version 26.02.0 can be triggered by a crafted media file, causing the application to crash and leading to a denial of service. The weakness is a dereference of an invalid pointer, which underlines the potential for service disruption when the software processes malicious content.

Affected Systems

All users of GPAC Project/MP4Box versions earlier than 26.02.0 are vulnerable. The issue resides in the filter_pid.c component of the project, affecting any deployment that processes MP4 or other supported media containers with this version of the tool.

Risk and Exploitability

The vulnerability enables processes that can supply arbitrary input to MP4Box to stop the service. The EPSS score is not available, and the issue is not listed in CISA KEV; the operational impact is clear, but no evidence of widespread exploitation is available.

Generated by OpenCVE AI on June 25, 2026 at 01:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update GPAC MP4Box to version 26.02.0 or newer to apply the NULL pointer dereference fix.
  • Avoid feeding untrusted or unknown media files into MP4Box; quarantine or validate inputs before processing.
  • If an update cannot be applied immediately, run MP4Box in a restricted environment or container to isolate potential crashes and limit service disruption.

Generated by OpenCVE AI on June 25, 2026 at 01:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 25 Jun 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Gpac
Gpac mp4box
Vendors & Products Gpac
Gpac mp4box

Thu, 25 Jun 2026 01:30:00 +0000

Type Values Removed Values Added
Title NULL Pointer Dereference in GPAC MP4Box Leading to Denial of Service
Weaknesses CWE-476

Wed, 24 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
References

Subscriptions

Gpac Mp4box
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-06-24T23:18:32.527Z

Reserved: 2025-09-26T00:00:00.000Z

Link: CVE-2025-60473

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-25T06:30:16Z

Weaknesses