Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

GPAC MP4Box heap use-after-free in packet destruction (CVE-2025-60478)

Original title: CVE-2025-60478: Heap use-after-free in GPAC/MP4Box packet destruction via crafted MPEG-2 TS file

oss-security ()1 · 1 read
Read at seclists.org
Part of a story covered by 6 sourcesShvedov posts multiple unexploited GPAC MP4Box memory bugsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

The bug is in 2.5-DEV-rev1617 and scores CVSS 7.8 with local access and user interaction.

Alexander A. Shvedov reported a heap use-after-free in gf_filter_packet_destroy() in GPAC's MP4Box. A crafted MPEG-2 TS file can trigger it in 2.5-DEV-rev1617-g856674b22-master. The fix is commit c592a144bbe339ee581ca88aaa3247362795b742. BDU rated it CVSS 3.1 7.8 HIGH.

Key facts
  • CWE-416; vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
  • Vulnerable commit is 856674b226d6cbe28a941ad223be38194cbf7d37.
  • Posted on October 22 by Alexander A. Shvedov (@sigdevel).
  • Fixed commit is c592a144bbe339ee581ca88aaa3247362795b742.
Security assessment · AI, from the article

Impact: Heap use-after-free via a crafted MPEG-2 TS file

ProductAffectedFixed in
GPAC MP4Box2.5-DEV-rev1617-g856674b22-masterc592a144bbe339ee581ca88aaa3247362795b742
What to do
  1. 1.Update GPAC to commit c592a144bbe339ee581ca88aaa3247362795b742.
Analyze CVE-2025-60478 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2025-60478
ATT&CK
T1204.002 Malicious File
Tags
gpacmp4boxuse-after-freempeg-2cwe-416
Vendors
GPAC
Products
MP4Box

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2025-60478
A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of…
5.5—

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
sha1856674b226d6cbe28a941ad223be38194cbf7d37(MP4Box) Affected: 2.5-DEV-rev1617-g856674b22-master Commit 856674b226d6cbe28a941ad223be38194cbf7d37 Fixed: c592a144bbe339ee581ca88aaa3247362795b742 CVE: CVE-20
sha1c592a144bbe339ee581ca88aaa3247362795b742ster Commit 856674b226d6cbe28a941ad223be38194cbf7d37 Fixed: c592a144bbe339ee581ca88aaa3247362795b742 CVE: CVE-2025-60478 CWE: CWE-416 (Use After Free) CVSS 3.1:

From the original article

Posted by Alexander A. Shvedov on Oct 22 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1617-g856674b22-master Commit 856674b226d6cbe28a941ad223be38194cbf7d37 Fixed: c592a144bbe339ee581ca88aaa3247362795b742 CVE: CVE-2025-60478 CWE: CWE-416 (Use After Free) CVSS 3.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.