CVE-2025-60479 security flaw

Shvedov on Oct 22 Subject: CVE-2025-60479: NULL pointer dereference in GPAC/MP4Box StatSFVec2f via crafted BIFS scene Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1678-gb7ffd9f96-master Commit b7ffd9f96bc188dde148300d8c4e510b557563aa Fixed: 75786eb61b7cc838b57c3d4f8004b4f13b5b724c CVE: CVE-2025-60479 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; BDU assessment) Reporter: Alexander...

Published 22-Oct-2026 21:16 UTC · First seen 22-Oct-2026 21:14 UTC

Sources

• Open Source Security · 22-Oct-2026