CVE-2025-60481

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-60481
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-60481.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-60481
Downstream
Published
2026-06-01T00:00:00Z
Modified
2026-08-12T15:14:16Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A NULL pointer dereference in the gf_odf_ac4_cfg_dsi_v1 function (/odf/descriptors.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60481.json"
}
References

Affected packages

Git / github.com/gpac/gpac

Affected ranges

Type
GIT
Repo
https://github.com/gpac/gpac
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
118e60a905878e56dc4f9c5b309143c5f447c702
Fixed
e02d1fd24cdc26acb1b236ab38b3832cffcae21b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "MP4Box"
        },
        {
            "fixed": "26.02.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Other
abi-12
abi-13
abi-14
abi-15
abi-16
abi-12.*
abi-12.16
abi-12.17
abi-12.18
abi-12.19
abi-12.20
abi-12.21
abi-12.22
abi-12.23
abi-12.24
abi-12.25
abi-12.26
abi-12.27
abi-13.*
abi-13.0
abi-14.*
abi-14.0
abi-15.*
abi-15.0
abi-15.1
abi-15.2
abi-16.*
abi-16.2
abi-16.3
abi-16.4
abi-16.5
testtag0.*
testtag0.1
v0.*
v0.5.2
v0.6.0
v0.9.0
v0.9.0-preview
v1.*
v1.0.0
v2.*
v2.0.0
v2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-60481.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "170918395430451949194696949564863962491",
            "length": 579
        },
        "id": "CVE-2025-60481-24389f7c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/media_tools/av_parsers.c",
            "function": "gf_ac4_presentation_channel_mask_v1"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "146945592281864842586179279242979632028",
                "297012916819975192432025767229574850239",
                "227275428156068433394238283551749923849",
                "286617346507749187274678591782638235014",
                "336132397716280775548439291960308380398",
                "84364633517352568668864332904946441959",
                "56677209249496325853775221690718012371",
                "186886722663021841665714196000759700066",
                "320133489679141387632522929107340129242",
                "206136260224161366082493515482007447114",
                "126474654088917099557893326096709237490",
                "19500034083579600205700187086289098294",
                "135040001861682879386930705441291951365",
                "181297475272340019449360578467135501194",
                "309007297216107053421652995071777170489",
                "318681428847768277672943876498219152747",
                "312366669927290196568785509947920126521",
                "19500034083579600205700187086289098294",
                "135040001861682879386930705441291951365",
                "181297475272340019449360578467135501194",
                "309007297216107053421652995071777170489",
                "19500034083579600205700187086289098294",
                "135040001861682879386930705441291951365",
                "181297475272340019449360578467135501194",
                "309007297216107053421652995071777170489",
                "82115827197810574364915098848912123927",
                "311087018931071555034281317673773253274",
                "201592515517049390485773607660916965532",
                "244579240897701627311099493141270070438",
                "184933994142971080206801008888260578418",
                "275981797122523483758029867560292079421",
                "252768333902168661468602665577214825773",
                "193642798181891272947988973409984230800",
                "156599910978304925199854030752023118769",
                "333861869253301687898203390214528682615",
                "75025386270855694237200874084139508624",
                "193496696667012459194243044867847919907",
                "308489416709014129992229087010139023603",
                "251474400757949703617538840707975092003",
                "335207751074581597005373074307287492263",
                "44875604317293523767020461783812081625",
                "229131116621066740267396693080129696075",
                "212856392702319615381606001412007080106",
                "127961278838236921390397870542693988509",
                "330955306359532384611010117631312363714",
                "42757950138872043606485902055461260274",
                "25165282340795668307089240412124456450",
                "174813971115554979930754703261628993826",
                "229414240163762203571953763918163104250"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-60481-26890409",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/media_tools/av_parsers.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "255367381293972963987642552204455203349",
            "length": 384
        },
        "id": "CVE-2025-60481-3109066f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/media_tools/av_parsers.c",
            "function": "gf_ac4_get_presentation_by_substreamgroup"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "211409938012423231373153632255945385149",
            "length": 4609
        },
        "id": "CVE-2025-60481-3f8b777a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/media_tools/av_parsers.c",
            "function": "gf_ac4_raw_frame"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "175990694299964657188034414399972008200",
            "length": 5181
        },
        "id": "CVE-2025-60481-717a35ff",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/odf/descriptors.c",
            "function": "gf_odf_ac4_cfg_presentation_v1_dsi"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "330286385672771246955479143293403114811",
            "length": 3436
        },
        "id": "CVE-2025-60481-785c6cd4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/media_tools/av_parsers.c",
            "function": "gf_ac4_presentation_v1_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "69852200360567166483410222936837932174",
            "length": 539
        },
        "id": "CVE-2025-60481-79ce4865",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/odf/descriptors.c",
            "function": "gf_odf_ac4_cfg_deep_copy"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "262934645764528351654131003879054536670",
            "length": 480
        },
        "id": "CVE-2025-60481-82e5bffa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/media_tools/av_parsers.c",
            "function": "gf_ac4_presentation_ch_mode"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "300516408080070501359172155663207055373",
            "length": 913
        },
        "id": "CVE-2025-60481-8ff72dd4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/odf/descriptors.c",
            "function": "gf_odf_ac4_cfg_clean_list"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "276374145763499027360584075725719634764",
            "length": 870
        },
        "id": "CVE-2025-60481-9352ed1f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/odf/descriptors.c",
            "function": "gf_odf_ac4_cfg_substream_group_dsi"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "232753676181184679086336710173094049015",
            "length": 4041
        },
        "id": "CVE-2025-60481-9b3b15a1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/odf/descriptors.c",
            "function": "gf_odf_ac4_cfg_dsi_v1"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "5427766232554500213975004703950396547",
            "length": 875
        },
        "id": "CVE-2025-60481-a1cac602",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/media_tools/av_parsers.c",
            "function": "gf_ac4_get_b_presentation_core_differs"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "191277226674945866586696163656468753491",
                "149353677665132438928468111991672987398",
                "152992764439105806957230441442095951225",
                "166501463187268832197872954664047253028",
                "201765041536564183177321125744504813032",
                "50116806935300192667417437449965709613",
                "20548494656795907812781724390316931180",
                "151342103204585544874735918021013711157",
                "172792776347687560525068600395771470254",
                "296251906570265175529885123815707596643",
                "328851485614032246736211744866740224602",
                "298811356564260781540775920046966118512",
                "118127215953227004506774643030276913967",
                "39752841585775238991483933204726898748",
                "97271379575976917367926407458493746346",
                "307708796745973403680574183440549786692",
                "326345326783894568543356941234311843343",
                "212798879613463270308221836738180180803",
                "18310749740026633322558024777911342692",
                "171194068248183489941312538824042188274",
                "42631944112766235083801458012452092717",
                "107673858913477745550625111652925393638",
                "260570737659376705241375904179058379627",
                "168730171981300485837103426183114662391",
                "199467439966927028325879085459614670347",
                "287151114375151613059872861076366107532",
                "41088983115997757381084642520910772527",
                "49491422454257104700962801872134675934",
                "274642577025728413482253533805882182927",
                "122252504083535286361458636893584633246",
                "148512953077564550215659984315142661085",
                "101284612111306037904768668209414744092",
                "133839081536692497242088642201993268572",
                "170492454135963130147502883853855860883",
                "230556047578643073719264211572549428526",
                "78152343402020035865013767510572110273",
                "159127661506704982498346948273858114309",
                "204459529756708448785998637718080708045",
                "137304145509548634330532930214906800031",
                "110380803801111739355928026088381260233",
                "143473945384312356324304982351312324596",
                "58458891189506050697858247486055569674",
                "182313748981472089930331569087910250835",
                "221303624154253757964765115420092023798",
                "204025373813434028134195154949884117776",
                "162286015183339449972883152562934323517",
                "36018458185986726563982152717812869340",
                "175639098914327363838228165956867468465",
                "109914413665721790421655505844529688951",
                "66432039610374034276069860058697325327",
                "161477991171016747824288956933842891338",
                "316295434682010603229757326589805652015",
                "329298345957668447072314127323857519064",
                "240609590918643060253587812132986373729",
                "92582763093108418559871827478329234670",
                "73226042120829993756929243209751006620",
                "68480213899199571963702160474058229054",
                "145958739774245365333911880646549813855",
                "187072434131270743502064190382380421486",
                "232285637258036429051283021680222496989",
                "219367772174759173637157580848547505837",
                "311608379186160113779273829903796107583",
                "332129161655916708924206347860257201010",
                "214948398305840371573492049689198979340",
                "186552235751563283578933981787921432760",
                "3352493864848555004345880920797135918",
                "85093792319119971163088473630009670866",
                "140628485969532621276749155213558220815",
                "260193915295197132735699327826637961244",
                "225896200219000573701736330432890746820",
                "99625769552465381710243343347525433105",
                "333772916416046042756357318912308480055",
                "209626536039479988438059502332656729898",
                "201135273480073388964815275542799892414",
                "336740038249390683263486120548767700568",
                "7347328340090920586341518961786638316",
                "198767826138860093102296246464197191678",
                "100270844595429181886913518640288734503",
                "137433139055341724807033190991783112067",
                "237989613213394484166249669805700007219",
                "144435934122905938252993792024097257924",
                "175159714608678139543981816714535105486"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-60481-b9f5764b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/odf/descriptors.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "168533692420144644298788104703949075855",
            "length": 582
        },
        "id": "CVE-2025-60481-c4005944",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/odf/descriptors.c",
            "function": "gf_odf_ac4_cfg_alternative_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "87956492104423341249646744850786814883",
            "length": 2182
        },
        "id": "CVE-2025-60481-ca3ce967",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/media_tools/av_parsers.c",
            "function": "gf_ac4_substream_group_info"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "60225489081522074108261144170788941372",
            "length": 1386
        },
        "id": "CVE-2025-60481-d310f41e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/media_tools/av_parsers.c",
            "function": "gf_ac4_parser_bs"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "173363764463972609494151512777274871912",
            "length": 925
        },
        "id": "CVE-2025-60481-dc474d9d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b",
        "target": {
            "file": "src/odf/descriptors.c",
            "function": "gf_odf_ac4_presentation_deep_copy"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:14:16Z"