GPAC MP4Box CVE-2025-60497

Exploitation requires a user or automated workflow to process (open/parse) an attacker-supplied crafted MP4 file with a vulnerable GPAC/MP4Box build before version 2.5; the malicious file must contain a track-dependency ('dpnd') structure whose trackIDCount is zero/invalid, which GetESD() dereferences without validation, producing a segmentation fault. Limiting factors: the vector is local (AV:L) and the attack cannot be triggered remotely without the victim handling the file (UI:R); impact is confined to availability (process crash), with no confidentiality or integrity consequence and no evidence of code execution. Risk is realistic only where MP4Box ingests untrusted media (e.g. upload/transcode pipelines), and is nullified by upgrading to 2.5 or applying the trackIDCount guard.

This is a genuine but low-priority vulnerability - a memory-safety DoS, not a critical RCE. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5 MEDIUM) is internally consistent with the description: local attack vector, no privileges but requiring user interaction (a victim must process the attacker's file), and impact limited to availability (process crash) with no confidentiality or integrity loss. Publicly available exploit code exists (github-poc reference and vuldb advisory), which raises practical risk slightly, but this must NOT be conflated with active exploitation - there is no CISA KEV listing and no EPSS score in the input, so widespread or automated exploitation is not evidenced. No SSVC decision data was provided. The source-code evidence confirms the root cause: GetESD() dereferenced a dependency structure (dpnd) without checking dpnd->trackIDCount, and the fix adds that guard - consistent with a NULL/invalid-pointer segmentation fault rather than a controllable corruption primitive. Net: a real, patch-this issue for anyone running MP4Box on untrusted media, but it does not warrant emergency prioritization given availability-only impact and the required user interaction.

An attacker crafts a malformed MP4 file and delivers it to a victim or an automated media-processing pipeline that uses GPAC/MP4Box (before 2.5). When the file is parsed, GetESD() in isomedia/track.c accesses an invalid track-dependency structure and the process crashes with a segmentation fault, denying service. Public proof-of-concept exploit code already exists, lowering the barrier to triggering the crash; however, exploitation requires the victim to actually process the file (UI:R) and yields only a crash, not code execution.