Heap Use-After-Free Vulnerability in GPAC Project MP4Box
CVE-2025-60490

5.5MEDIUM

Key Information:

Vendor

GPAC Project

Status
MP4Box
Vendor
CVE Published:
21 October 2026

What is CVE-2025-60490?

A heap use-after-free vulnerability in the gf_filter_pid_send_event_downstream function located in /filter_core/filter_pid.c of MP4Box prior to version 2.5 allows attackers to craft malicious MP4 files. Exploiting this flaw could lead to Denial of Service (DoS) conditions, potentially disrupting service for users relying on this media processing application. It is essential for users and administrators to apply the necessary updates to safeguard against this critical weakness.

References

https://github.com/gpac/gpac/issues/3315
https://github.com/gpac/gpac/commit/d0793f92e04fe284a25c2...
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Bo...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.