Stack Overflow Vulnerability in GPAC MP4Box Affects Playable Media Files
CVE-2025-60492

5.5MEDIUM

Key Information:

Vendor

GPAC Project

Status
MP4Box
Vendor
CVE Published:
21 October 2026

What is CVE-2025-60492?

The GPAC Project's MP4Box, prior to version 2.5, is susceptible to a stack overflow vulnerability in the gf_bifs_dec_node function located in /bifs/field_decode.c. This security flaw allows attackers to exploit the software by submitting a specially crafted MP4 file, leading to potential Denial of Service (DoS) incidents. Successful exploitation may disrupt the application's normal functionality, highlighting the importance of timely updates and vigilance in security practices.

References

https://github.com/gpac/gpac/issues/3324
https://github.com/gpac/gpac/commit/8e7b9a3a04331286b89d1...
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Bo...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.