GPAC MP4Box use-after-free in filter event path (CVE-2025-60490)
Original title: CVE-2025-60490: heap use-after-free in GPAC/MP4Box gf_filter_pid_send_event_downstream via crafted MPEG-2 TS input
Crafted MPEG-2 TS hits gf_filter_pid_send_event_downstream; the stated fix is commit d0793f92.
Alexander A. Shvedov reported CVE-2025-60490, a heap use-after-free (CWE-416) in GPAC MP4Box. Crafted MPEG-2 TS input triggers the flaw in gf_filter_pid_send_event_downstream(). The affected revision is 2.5-DEV-rev1665-g3f20eb0cd-master, fixed in commit d0793f92e04fe284a25c2a9335cc5edc68deb6d4. The listed CVSS 3.1 score is 8.8 High and cites a BDU assessment.
- Vector is network with low complexity, no privileges and user interaction.
- Confidentiality, integrity and availability are each rated high.
- Affected commit is 3f20eb0cd22116367c036e6ffe6ace299b38d686.
- The oss-security post is dated October 23.
Impact: Heap use-after-free from crafted MPEG-2 TS input
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1665-g3f20eb0cd-master | d0793f92e04fe284a25c2a9335cc5edc68deb6d4 |
- 1.Update MP4Box to commit d0793f92e04fe284a25c2a9335cc5edc68deb6d4.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60490 | A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to… | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 3f20eb0cd22116367c036e6ffe6ace299b38d686 | (MP4Box) Affected: 2.5-DEV-rev1665-g3f20eb0cd-master Commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 Fixed: d0793f92e04fe284a25c2a9335cc5edc68deb6d4 CVE: CVE-20 |
| sha1 | d0793f92e04fe284a25c2a9335cc5edc68deb6d4 | ster Commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 Fixed: d0793f92e04fe284a25c2a9335cc5edc68deb6d4 CVE: CVE-2025-60490 CWE: CWE-416 (Use After Free) CVSS 3.1: |
From the original article
Posted by Alexander A. Shvedov on Oct 23 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1665-g3f20eb0cd-master Commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 Fixed: d0793f92e04fe284a25c2a9335cc5edc68deb6d4 CVE: CVE-2025-60490 CWE: CWE-416 (Use After Free) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.