GPAC MP4Box CVE-2025-60489

Exploitation requires that MP4Box (GPAC before 2.5) locally parse an attacker-crafted MP4 file through its dasher/DASH-segmentation code path, where an unchecked pointer in dasher_insert_timeline_entry is dereferenced. Limiting factors: the attack vector is local (AV:L) and requires user interaction (UI:R) - a user or automated job must invoke MP4Box on the malicious file; there is no remote or network-triggered path and no authentication is involved (PR:N). Impact is confined to a denial-of-service crash (A:H only); there is no confidentiality or integrity impact. The realistic exposure is automated pipelines that run MP4Box over untrusted/uploaded media.

This is a genuine but low-urgency issue, correctly rated medium (CVSS 5.5). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H is internally consistent with the mechanism: a NULL pointer dereference reached only when MP4Box locally processes an attacker-supplied crafted MP4 file (AV:L, UI:R), causing an availability-only crash (C:N/I:N/A:H). The source commit confirms the root cause - an unchecked pointer s dereferenced in dasher_insert_timeline_entry, fixed by adding an s && prev_patch_dur guard. All exploitation signals point the same way, with no conflict: EPSS is 0.16% (5th percentile), the product is not in CISA KEV, and the input shows a public PoC reference that is not verified as working exploit code. The vuln.today decision label is 'this_month', not act_now or emergency. The net real-world risk is a denial-of-service (process crash) against whoever runs MP4Box over untrusted input - a concern for automated media-processing pipelines but not a widespread or remotely-triggerable threat, and there is no confidentiality or integrity impact.

An attacker crafts a malformed MP4 file and gets a victim or an automated system to process it with MP4Box (for example, a media-conversion or DASH-packaging pipeline that ingests user-uploaded files). When MP4Box parses the file, the dasher code dereferences a NULL pointer and the process crashes, denying service. A public PoC reference exists but is not verified as working exploit code, and exploitation requires local processing of the file (user interaction).