GPAC MP4Box AC-4 cleanup use-after-free disclosed as CVE-2025-60482
The confirmed build is 2.5-DEV-rev1593-gfe88c3545-master; CISA ADP scores it 5.5 for local availability impact only.
42
CVE-2025-60482
Heap use-after-free in GPAC MP4Box AC4 cleanup
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A heap use-after-free in gf_odf_ac4_cfg_clean_list (odf/descriptors.c) affects GPAC Project MP4Box 2.5-DEV-rev1593-gfe88c3545-master. A local attacker can trigger it by supplying a crafted AC4 file that a user opens. Impact is denial of service only (availability); confidentiality and integrity are not affected. Users of that development build who process untrusted AC4 files are affected.
What to do: No fixed version is stated for MP4Box 2.5-DEV-rev1593-gfe88c3545-master.
| Product | Affected |
|---|---|
| GPAC Project MP4Box | 2.5-DEV-rev1593-gfe88c3545-master |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H