[<prev] [next>] [day] [month] [year] [list]
Message-ID: <trinity-0fd7d04b-388f-46b9-9342-63310935f199-1780348480303@3c-app-mailcom-bs08>
Date: Mon, 1 Jun 2026 23:14:40 +0200
From: "Alexander A. Shvedov" <shvedov@....com>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-60481: NULL Pointer Dereference in GPAC/MP4Box via
gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stream
Product: GPAC (MP4Box)
Affected: gpac/gpac prior to commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b
CVE: CVE-2025-60481
CWE: CWE-476 (NULL Pointer Dereference)
CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description:
The function gf_odf_ac4_cfg_dsi_v1 in odf/descriptors.c:2148 parses AC-4
audio stream descriptor sub-configurations during media import. When
MP4Box processes a specially crafted AC-4 file via -info, the parsing
pipeline (ac4dmx_check_pid -> gf_odf_ac4_cfg_write -> gf_odf_ac4_cfg_dsi_v1)
encounters an invalid or missing DSI substructure pointer.
The code does not validate the pointer before dereferencing it, resulting
in a null pointer dereference (READ at address 0x000000000000) and an
immediate fatal crash under AddressSanitizer.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: `--static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0"` ;
-Command: ./MP4Box -info 45_gf_odf_ac4_cfg_dsi_v1_odf_descriptors_c_2148
Asan-log:
==1848484==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f77c30a5cfa bp 0x000000000000 sp 0x7ffdad34e3d0 T0)
==1848484==The signal is caused by a READ memory access.
#0 0x7f77c30a5cfa in gf_odf_ac4_cfg_dsi_v1 odf/descriptors.c:2148
#1 0x7f77c30a6ae1 in gf_odf_ac4_cfg_write_bs odf/descriptors.c:2281
#2 0x7f77c30a6ae1 in gf_odf_ac4_cfg_write odf/descriptors.c:2288
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/45/45_gf_odf_ac4_cfg_dsi_v1_odf_descriptors_c_2148
References:
https://github.com/gpac/gpac/issues/3296
https://nvd.nist.gov/vuln/detail/CVE-2025-60481
https://www.cve.org/CVERecord?id=CVE-2025-60481
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
