GPAC MP4Box AC-4 parser over-reads a buffer (CVE-2025-60475)
gf_ac4_parser_bs indexes a rate table with a frame_rate_index taken from a crafted AC-4 stream.
42
Vulnerability1 · 1 read
CVE-2025-60475
Buffer overflow DoS in GPAC MP4Box before 2.5
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A buffer overflow in gf_ac4_parser_bs (/media_tools/av_parsers.c) in GPAC MP4Box before 2.5 can crash the process when a crafted AC-4 stream is parsed. A local attacker needs the user to open that input; no privileges are required. Impact is denial of service only. Users of MP4Box before 2.5 are affected.
What to do: Upgrade GPAC MP4Box to 2.5.
| Product | Affected | Fixed in |
|---|---|---|
| GPAC Project MP4Box | before 2.5 | 2.5 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
- Weakness
- CWE-119
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H