Heap Use-After-Free Vulnerability in GPAC Project's MP4Box Product
CVE-2025-60491

5.5MEDIUM

Key Information:

Vendor

GPAC Project

Status
MP4Box
Vendor
CVE Published:
21 October 2026

What is CVE-2025-60491?

This vulnerability in the GPAC Project's MP4Box relates to a heap use-after-free condition in the dasher_flush_segment function, specifically located in /filters/dasher.c. Attackers can exploit this weakness by supplying a specially crafted MP4 file, which may lead to Denial of Service (DoS) by destabilizing the application's operation, effectively making it unresponsive. Users of MP4Box version 2.5 and earlier are advised to take caution and apply any available updates or patches to mitigate the risk associated with this vulnerability.

References

https://github.com/gpac/gpac/issues/3326
https://github.com/gpac/gpac/commit/f6128214feb69cd689e4b...
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Bo...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.