[<prev] [next>] [day] [month] [year] [list]
Message-ID: <trinity-a59c8e18-a159-4078-8428-c09bec142c2d-1780348624451@3c-app-mailcom-bs08>
Date: Mon, 1 Jun 2026 23:17:04 +0200
From: "Alexander A. Shvedov" <shvedov@....com>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-60483: NULL Pointer Dereference in GPAC/MP4Box via
gf_ac4_pres_b_4_back_channels_present on crafted AC-4 stream
Product: GPAC (MP4Box)
Affected: gpac/gpac prior to fix commit (see References)
CVE: CVE-2025-60483
CWE: CWE-476 (NULL Pointer Dereference)
CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description:
The gf_ac4_pres_b_4_back_channels_present function in media_tools/av_parsers.c
accesses presentation substream group data using an index derived from the AC-4
stream. When a crafted AC-4 file specifies an invalid substream group index
(e.g., group 4 that does not exist for presentation 0), the parser reaches
line 15703 without first validating the index against the available group count.
The invalid index causes a dereference of pres->substream_groups at a 72-byte
offset from a NULL or uninitialized base pointer (READ at address 0x000000000048),
terminating the process with SIGSEGV. No evidence of arbitrary code execution
was observed; the impact is limited to Denial of Service.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: `--static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0"` ;
-Command: ./MP4Box -dash 100 49_gf_ac4_pres_b_4_back_channels_present_media_tools_av_parsers_c_15703
Asan-log:
==56315==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000048 (pc 0x7f3ff4b7f8d1 bp 0x0a100000018e sp 0x7ffcf2d7c730 T0)
==56315==The signal is caused by a READ memory access.
#0 0x7f3ff4b7f8d1 in gf_ac4_pres_b_4_back_channels_present media_tools/av_parsers.c:15703
#1 0x7f3ff4b7f8d1 in gf_ac4_raw_frame media_tools/av_parsers.c:15999
#2 0x7f3ff4b7f8d1 in gf_ac4_parser_bs media_tools/av_parsers.c:16141
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/49/49_gf_ac4_pres_b_4_back_channels_present_media_tools_av_parsers_c_15703
References:
https://github.com/gpac/gpac/issues/3302
https://nvd.nist.gov/vuln/detail/CVE-2025-60483
https://www.cve.org/CVERecord?id=CVE-2025-60483
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
