# CVE-2025-60479: GPAC MP4Box NULL pointer dereference in StatSFVec2f

Source: https://junglewise.ai/threats/cve-2025-60479-a-null-pointer-dereference-in-the-statsfvec2f-function-scene  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2025-60479 · Severity: info · Published 2026-10-21

MP4Box is a multimedia file manipulation tool used to process and analyze MPEG-4 video files. A null pointer dereference vulnerability in the scene statistics function allows an attacker to crash the application by providing a specially crafted MPEG-4 file with malformed vector data, causing a denial of service during file analysis.

Technologies: [GPAC Project MP4Box](https://junglewise.ai/threats/technologies/gpac-project-mp4box). Vendors: [GPAC Project](https://junglewise.ai/threats/vendors/gpac-project).

## Quick answers

**Is CVE-2025-60479 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60479 being exploited in the wild.

**How severe is CVE-2025-60479?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** GPAC Project MP4Box before 2.5.

**Is there a fix for CVE-2025-60479?** Yes: fixed in MP4Box 2.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-60479 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-60479?** Check whether you run GPAC Project MP4Box at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in MP4Box 2.5

## Technical details

A NULL pointer dereference exists in the StatSFVec2f function in scene_manager/scene_stats.c when processing MPEG-4 BIFS scenes with malformed vector fields. The vulnerability occurs when the statistics collection code fails to validate pointer integrity before accessing SFVec2f structures. An attacker can trigger a segmentation fault by supplying a crafted MPEG-4 file; the fix validates pointers before dereferencing them.

## Affected products

- GPAC Project MP4Box before 2.5

## Timeline

- 2025-08-07: disclosed: Vulnerability reported via GitHub issue #3322
- 2025-08-07: patched: Fixed in commit 75786eb

## References

- [https://github.com/gpac/gpac/commit/75786eb61b7cc838b57c3d4f8004b4f13b5b724c](https://github.com/gpac/gpac/commit/75786eb61b7cc838b57c3d4f8004b4f13b5b724c)
- [https://github.com/gpac/gpac/issues/3322](https://github.com/gpac/gpac/issues/3322)

## Related threats

- [GPAC MP4Box heap use-after-free in AC4 descriptor parsing](https://junglewise.ai/threats/cve-2025-60476-a-heap-use-after-free-in-the-gf-odf-ac4-cfg-clean-list-function)
- [GPAC MP4Box NULL pointer dereference in AC4 parser](https://junglewise.ai/threats/cve-2025-60469-a-null-pointer-dereference-in-the-gf-ac4-presentation-ch-mode)
- [GPAC MP4Box null pointer dereference in GetESD](https://junglewise.ai/threats/cve-2025-60497-a-segmentation-violation-in-the-getesd-function-isomedia-track-c)
- [GPAC MP4Box segmentation violation in check_media_profile](https://junglewise.ai/threats/cve-2025-60493-a-segmentation-violation-in-the-check-media-profile-function)
- [GPAC MP4Box stack overflow in BIFS scene decoder](https://junglewise.ai/threats/cve-2025-60492-a-stack-overflow-in-the-gf-bifs-dec-node-function-bifs-field)