GPAC MP4Box CVE-2025-60485

Exploitation requires that a victim user or automated process invokes a vulnerable version of GPAC MP4Box (before 26.02.0) on a specially crafted MP4 file. The CVSS vector specifies UI:R (user interaction required), confirming the attack cannot be triggered remotely without a user or pipeline actively processing the malicious file. The local attack vector (AV:L) means the crafted file must be delivered to a system where MP4Box will process it - via file upload, shared storage, email, or similar delivery mechanism. No authentication is required on the attacker's part (PR:N), but the victim must actively open or process the file with MP4Box. Exploitation is strictly bounded to availability impact - no code execution, privilege escalation, or data disclosure is possible. Risk is further limited to environments where MP4Box processes externally supplied or untrusted MP4 content; deployments operating exclusively on internally generated files are not at meaningful risk.

CVSS 5.5 Medium accurately reflects the constrained blast radius: the attack vector is local (AV:L), user interaction is required (UI:R), no privileges are required from the attacker (PR:N), and impact is limited to high availability loss with no confidentiality or integrity exposure (C:N/I:N/A:H). Real-world risk is elevated specifically for automated media processing pipelines that ingest user-supplied MP4 files, since those workflows effectively satisfy the UI:R requirement programmatically. A publicly available proof-of-concept lowers the exploitation barrier and increases opportunistic risk in such environments. EPSS data was not provided in the input; in its absence, risk should not be assumed low given the POC availability. No CISA KEV listing exists, meaning widespread active exploitation is not confirmed. The local attack vector prevents remote unauthenticated exploitation against network services - this is not a remotely triggerable crash against a listening daemon, but rather a file-parsing vulnerability requiring delivery of a malicious artifact.

An attacker crafts a malformed MP4 file that provides null or empty values for custom iTunes-style tag mean or name fields, triggering the unguarded null pointer dereference in gf_isom_apple_set_tag_ex. The file is delivered to a target - for example, uploaded to a media transcoding service, placed in a shared network folder, or sent as an email attachment - and a user or automated pipeline invokes MP4Box against it. The process crashes with a segmentation fault, causing denial of service; a publicly available proof-of-concept hosted at https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/52/README.md demonstrates this behavior and lowers the technical barrier for exploitation.