Description
A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Published: 2026-10-21
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Monitor
AI Analysis

Impact

A segmentation violation in the check_media_profile function in /mp4box/mp4box.c of GPAC Project MP4Box before version 2.5 allows an attacker to supply a crafted MP4 file that causes a segmentation fault and crashes the executable. The flaw results in a denial-of-service condition but does not provide code execution or data disclosure.

Affected Systems

This vulnerability affects any installation of the GPAC Project MP4Box utility with a version prior to 2.5. The issue resides exclusively in the MP4Box component located at /mp4box/mp4box.c and no other vendors or products are listed.

Risk and Exploitability

The failure occurs when the vulnerable function processes malformed MP4 data, triggering a segmentation fault and terminating the process. An attacker able to supply the crafted MP4 file can induce repeated crashes, potentially taking a dependent service offline. The CVSS score is 5.5, EPSS is < 1%, and the vulnerability is not listed in the CISA KEV catalog, so the precise exploitation likelihood remains unclear; nevertheless, the ability to cause a crash poses a significant availability risk.

Generated by OpenCVE AI on October 26, 2026 at 20:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • No official patch is available; monitor vendor releases for an update that addresses the null pointer dereference in check_media_profile.
  • If an upgrade is not feasible, run MP4Box within a sandbox or container to isolate crashes and prevent denial of service from affecting the host environment.
  • Implement an upstream validation routine that checks MP4 file headers for validity before passing them to MP4Box, thereby preventing malformed files that could trigger the null dereference, which is the core issue identified by CWE-476.
  • For developers: augment the GPAC source to include explicit null‑pointer checks around the media profile data before dereferencing, ensuring compliance with safe programming practices outlined in CWE-476.

Generated by OpenCVE AI on October 26, 2026 at 20:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Title Segmentation Fault in GPAC MP4Box Allowing Denial of Service

Mon, 26 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 25 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
References

Thu, 22 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Title Segmentation Fault in GPAC MP4Box Allowing Denial of Service
Weaknesses CWE-476

Wed, 21 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Gpac
Gpac mp4box
Vendors & Products Gpac
Gpac mp4box

Wed, 21 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Segmentation Violation in GPAC MP4Box Leading to Denial of Service
Weaknesses CWE-476

Wed, 21 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Title Segmentation Violation in GPAC MP4Box Leading to Denial of Service
Weaknesses CWE-476

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
References

Subscriptions

Gpac Mp4box
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-26T17:33:37.529Z

Reserved: 2025-09-26T00:00:00.000Z

Link: CVE-2025-60493

cve-icon Vulnrichment

Updated: 2026-10-25T00:19:25.163Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T15:17:14.140

Modified: 2026-10-28T14:10:00.220

Link: CVE-2025-60493

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T20:30:15Z

Weaknesses