Heap Use-After-Free Vulnerability in GPAC Project's MP4Box Software
CVE-2025-60476

5.5MEDIUM

Key Information:

Vendor

GPAC Project

Status
MP4Box
Vendor
CVE Published:
21 October 2026

What is CVE-2025-60476?

A vulnerability exists in GPAC Project's MP4Box prior to version 2.5 due to a heap use-after-free condition occurring in the gf_odf_ac4_cfg_clean_list function. This vulnerability can be exploited by attackers through specially crafted AC4 files, which may lead to unintended behavior such as Denial of Service (DoS). Addressing this issue is crucial to preventing potential service interruptions and ensuring the reliability of media playback processing.

References

https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b23...
https://github.com/gpac/gpac/issues/3293
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Bo...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.