GPAC MP4Box AC-4 cleanup use-after-free disclosed as CVE-2025-60482
The confirmed build is 2.5-DEV-rev1593-gfe88c3545-master; CISA ADP scores it 5.5 for local availability impact only.
42
Product
MP4Box
- Mentions · 7d5
- Mentions · 30d23
- All mentions23
- First seenOct 17, 2026
- Last mentioned1d ago
Timeline
23 articles · newest firstGPAC MP4Box AC-4 parser over-reads a buffer (CVE-2025-60475)
gf_ac4_parser_bs indexes a rate table with a frame_rate_index taken from a crafted AC-4 stream.
42
GPAC MP4Box use-after-free on crafted MPEG-2 TS (CVE-2025-60467)
The flaw is in a scheduled delete task in GPAC’s filter session core, triggered by a crafted MPEG-2 TS file.
42
GPAC MP4Box NULL dereference on crafted MP4 metadata (CVE-2025-60477)
The crash is in gf_filter_pid_resolve_file_template_ex while resolving DASH output file-name templates.
42
MP4Box NULL dereference via crafted MP4 (CVE-2025-60493)
A third-party CVSS 3.1 score of 4.3 rates the user-triggered flaw as a low-availability denial of service.
28
MP4Box GetESD NULL dereference via crafted MP4 (CVE-2025-60497)
GPAC 2.5-DEV commit 50b5741f2 crashes locally when a user opens a crafted MP4; the fix is commit 91083fcf.
32
GPAC MP4Box invalid read via crafted MP4 (CVE-2025-60494)
A local NULL-pointer read can crash MP4Box; CVSS is 5.5 and a fix commit is named.
42
GPAC MP4Box stack exhaustion in BIFS decoder (CVE-2025-60492)
Crafted MP4 input can recurse until the process stack is exhausted; CVSS is 5.5 medium.
42
GPAC MP4Box heap use-after-free via MPEG-2 TS (CVE-2025-60491)
The bug is in dasher_flush_segment() on 2.5-DEV-rev1698 and is fixed by commit f6128214.
48
GPAC MP4Box use-after-free in filter event path (CVE-2025-60490)
Crafted MPEG-2 TS hits gf_filter_pid_send_event_downstream; the stated fix is commit d0793f92.
48
GPAC MP4Box NULL dereference via crafted MP4 (CVE-2025-60489)
dasher_insert_timeline_entry() can crash on near-NULL; the fix commit is 4860a1a6.
34
GPAC MP4Box NULL dereference via crafted XML (CVE-2025-60487)
gf_isom_get_esd() crashes on near-NULL; fixed in commit e6d01820, CVSS 6.2.
36
GPAC MP4Box out-of-bounds read on crafted AC-4 (CVE-2025-71438)
A stream-supplied frame_rate_index indexes fixed lookup tables; the snippet states no fix or affected build.
36
GPAC MP4Box divide-by-zero on truncated MP4 (CVE-2025-60496)
A local user opening a crafted file can crash MP4Box; CVSS 3.1 is 5.5 and a fix commit is named.
40
GPAC MP4Box NULL dereference via crafted BIFS (CVE-2025-60479)
A crafted BIFS scene can crash StatSFVec2f locally; CVSS 3.1 is 5.5 and a fix commit is named.
40
GPAC MP4Box heap use-after-free in packet destruction (CVE-2025-60478)
The bug is in 2.5-DEV-rev1617 and scores CVSS 7.8 with local access and user interaction.
44
GPAC MP4Box AC-4 cleanup has heap use-after-free (CVE-2025-60476)
BDU scores it CVSS 8.8 with a network vector; the fix is commit e02d1fd24cdc.
52
GPAC MP4Box AC-4 parser NULL dereference via crafted file (CVE-2025-60469)
BDU scores the availability-only crash CVSS 5.5; the fix is commit e02d1fd24cdc.
36
GPAC MP4Box heap overflow via crafted AC-4 file (CVE-2025-60480)
The medium-severity out-of-bounds heap read is fixed in commit e02d1fd and rated CVSS 6.5.
44
GPAC MP4Box NULL dereference in dump_isom_saps (CVE-2025-55667)
A local crash in build 2.5-DEV-rev1672 is fixed in commit e6d01820 and rated CVSS 5.5.
36
GPAC MP4Box 2.4 use-after-free via crafted NHML input (CVE-2025-55654)
Impact is availability only: a local, low-privilege use-after-free scored CVSS 5.5 and fixed at commit 0ccd2927.
38
CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction
GPAC MP4Box divide-by-zero CVE-2025-55653 crashes the importer on crafted MP4 files with a zero-denominator fraction.
20
CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata
CVE-2025-55640 is a heap overflow in GPAC MP4Box triggered by crafted MP4 sample metadata.
46
Related CVEs
by mentions- CVE-2025-60467<1%7.5A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to…
- A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a…
- A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service…
- Heap buffer overflow DoS in GPAC MP4Box 2.4
- Heap use-after-free in GPAC MP4Box AC4 cleanup
- A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS)…
- A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via…
- A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of…
- A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS)…
- CVE-2025-60477<1%5.0A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows…
Appears with
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.