Product: GPAC (MP4Box)
Affected: gpac/gpac prior to commit 50b5741f291126b610c59db433fc02e8a17f0c5d
(GPAC version 2.5-DEV-rev1780-g50b5741f2-master)
CVE: CVE-2025-60495
CWE: CWE-476 (NULL Pointer Dereference)
CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description:
The function gf_media_get_color_info in media_tools/isom_tools.c:979 retrieves
color information from an ISO media sample entry during PID configuration in
the
MP4 muxer pipeline. When a crafted MP4 file contains a video sample entry
with an
inconsistent box structure (e.g., a v210 uncompressed video entry that
incorrectly
embeds an avcC AVC Decoder Configuration Box), the parser logs an "Unknown
box type"
warning and proceeds without properly initializing the entry's internal state.
The function subsequently dereferences a near-null pointer (READ at address
0x000000000008, 8 bytes into a NULL base) without validating the entry
structure,
terminating the process with SIGSEGV. No evidence of arbitrary code execution
was
observed; the impact is limited to Denial of Service.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: `CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g"`
;
-Command: ./MP4Box -split-size 8000
66_gf_media_get_color_info_media_tools_isom_tools_c_979
Asan-log:
==3196882==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc
0x7ff47af04f7e bp 0x0ffe8ce234c0 sp 0x7ffca3293ad0 T0)
==3196882==The signal is caused by a READ memory access.
#0 0x7ff47af04f7e in gf_media_get_color_info media_tools/isom_tools.c:979
#1 0x7ff47b82b690 in mp4_mux_setup_pid filters/mux_isom.c:3673
#2 0x7ff47b4adde1 in gf_filter_pid_configure filter_core/filter_pid.c:939
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/66/66_gf_media_get_color_info_media_tools_isom_tools_c_979
References:
https://github.com/gpac/gpac/issues/3335
https://nvd.nist.gov/vuln/detail/CVE-2025-60495
https://www.cve.org/CVERecord?id=CVE-2025-60495
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel
