EUVD-2025-210143
GHSA-v7rj-wmp7-c87g
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local file-based trigger with mandatory user interaction; impact is crash-only DoS - no confidentiality or integrity consequence applies.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
AnalysisAI
NULL pointer dereference in GPAC MP4Box v2.4 crashes the application when processing a specially crafted MP4 file, delivering a denial of service against any user or automated pipeline invoking the tool. The flaw is isolated to the TrackWriter handling component in filters/mux_isom.c, triggered by malformed MP4 input that causes an unvalidated pointer dereference. No public exploit code has been identified and this CVE does not appear in CISA KEV; SSVC rates exploitation status as none with no automation potential, consistent with a limited, file-delivery-dependent attack surface.
Technical ContextAI
GPAC is an open-source multimedia framework widely used for packaging, editing, and inspecting ISO Base Media File Format (ISOBMFF/MP4) containers; MP4Box is its primary command-line tool. The vulnerability resides in filters/mux_isom.c within the TrackWriter component, which handles track multiplexing during MP4 container construction and writing. CWE-476 (NULL Pointer Dereference) identifies the root cause class: a pointer is consumed without being validated for NULL, causing an access violation and process crash when malformed or structurally abnormal MP4 input causes an expected object reference to be absent - a pattern common in media demuxers and remuxers when crafted files bypass normal initialization paths. The CPE data provided (cpe:2.3:a:n/a:n/a) is non-specific and unusable for automated asset inventory queries; defenders must match directly against the explicit product and version string from the CVE description.
RemediationAI
No vendor-released patch version is confirmed from the available references. The primary technical references point to an oss-security mailing list post (http://www.openwall.com/lists/oss-security/2026/06/13/5) and a researcher post on infosec.exchange - neither confirms a tagged patched release. Patch availability per vendor advisory should be monitored directly in the GPAC project repository targeting filters/mux_isom.c. As a compensating control, organizations running automated MP4 processing pipelines should sandbox or containerize MP4Box invocations so that a process crash does not propagate to dependent services - note that sandboxing adds latency and operational overhead. Implement process watchdog/restart logic with alerting on abnormal termination to detect repeated crash attempts. Restrict ingestion of untrusted MP4 files into any pipeline invoking GPAC MP4Box 2.4 until a confirmed fix version is available from the vendor.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today