Executive summary — CVE-2025-60477 is a NULL pointer dereference in GPAC Project/MP4Box (specifically the function gf_filter_pid_resolve_file_template_ex in filter_core/filter_pid.c) that can be triggered by processing a specially crafted input file. In plain terms, MP4Box can crash (Denial of Service) when it encounters crafted metadata that leads the code to call strncmp() on a NULL string pointer. The issue is associated with GPAC/MP4Box versions before 26.02.0.
Technical details — The vulnerable code path is in gf_filter_pid_resolve_file_template_ex(GF_FilterPid *pid, ...), located at /filter_core/filter_pid.c. The GitHub issue (issues/3301) describes that when processing files with specially crafted metadata containing special characters, the function attempts a strncmp() operation on an uninitialized NULL pointer, causing a segfault. The referenced commit shows a defensive change around the “gmem://” prefix check: it adds a guard to ensure prop_val->value.string is non-NULL before calling strncmp(prop_val->value.string, "gmem://", 7). Concretely, the condition changes from checking only prop_val to checking both prop_val and prop_val->value.string (i.e., “if (prop_val && prop_val->value.string && !strncmp(...))”).
The exploitation mechanism is therefore a crafted MP4Box input that results in gf_filter_pid_resolve_file_template_ex obtaining a property value (via gf_filter_pid_get_property_first with GF_PROP_PID_FILEALIAS / GF_PROP_PID_FILEPATH) where the string field is NULL, but the code still reaches the prefix comparison. The result is a NULL pointer dereference during strncmp(), crashing the process. The issue’s reproduction indicates running MP4Box with dash options and a specially crafted file name/metadata to trigger the crash. No weaponizable code is provided in the references.
Impact — An attacker can cause a Denial of Service by crashing MP4Box during parsing/processing of a crafted file (segmentation fault). The NVD description characterizes this as a NULL pointer dereference leading to DoS. The provided CVSS score is not available (N/A) in the prompt, so severity is not quantified here; however, the described outcome is process termination. The blast radius is limited to availability of the MP4Box service/process that handles untrusted media inputs; there is no indication in the provided references of memory corruption beyond the crash or of remote code execution.
Mitigation — Upgrade GPAC/MP4Box to version 26.02.0 or later, as the NVD description states the issue exists before 26.02.0. The referenced fix (commit 13eb5b76560aaf7813b865a2ad433258478e2695) adds a NULL check for prop_val->value.string before performing the strncmp() comparison against the "gmem://" prefix. As a workaround, operators can reduce exposure by ensuring MP4Box only processes trusted inputs, and by isolating MP4Box in a sandbox/container so that a crash does not impact other services. Detection guidance: monitor MP4Box/MP4BoxBox processes for crashes/segfaults when ingesting media files, and correlate crashes with inputs that include unusual metadata (special characters) that could affect PID file alias/path template resolution.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CWE-476