[<prev] [next>] [day] [month] [year] [list]
Message-ID: <trinity-1c74adc1-1144-43fb-a985-458216dfac98-1780349266130@3c-app-mailcom-bs08>
Date: Mon, 1 Jun 2026 23:27:46 +0200
From: "Alexander A. Shvedov" <shvedov@....com>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-60495: NULL Pointer Dereference in GPAC/MP4Box via
gf_media_get_color_info on crafted MP4 with inconsistent sample entry
Product: GPAC (MP4Box)
Affected: gpac/gpac prior to commit 50b5741f291126b610c59db433fc02e8a17f0c5d (GPAC version 2.5-DEV-rev1780-g50b5741f2-master)
CVE: CVE-2025-60495
CWE: CWE-476 (NULL Pointer Dereference)
CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description:
The function gf_media_get_color_info in media_tools/isom_tools.c:979 retrieves
color information from an ISO media sample entry during PID configuration in the
MP4 muxer pipeline. When a crafted MP4 file contains a video sample entry with an
inconsistent box structure (e.g., a v210 uncompressed video entry that incorrectly
embeds an avcC AVC Decoder Configuration Box), the parser logs an "Unknown box type"
warning and proceeds without properly initializing the entry's internal state.
The function subsequently dereferences a near-null pointer (READ at address
0x000000000008, 8 bytes into a NULL base) without validating the entry structure,
terminating the process with SIGSEGV. No evidence of arbitrary code execution was
observed; the impact is limited to Denial of Service.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: `CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g"` ;
-Command: ./MP4Box -split-size 8000 66_gf_media_get_color_info_media_tools_isom_tools_c_979
Asan-log:
==3196882==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7ff47af04f7e bp 0x0ffe8ce234c0 sp 0x7ffca3293ad0 T0)
==3196882==The signal is caused by a READ memory access.
#0 0x7ff47af04f7e in gf_media_get_color_info media_tools/isom_tools.c:979
#1 0x7ff47b82b690 in mp4_mux_setup_pid filters/mux_isom.c:3673
#2 0x7ff47b4adde1 in gf_filter_pid_configure filter_core/filter_pid.c:939
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/66/66_gf_media_get_color_info_media_tools_isom_tools_c_979
References:
https://github.com/gpac/gpac/issues/3335
https://nvd.nist.gov/vuln/detail/CVE-2025-60495
https://www.cve.org/CVERecord?id=CVE-2025-60495
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
