GPAC MP4Box AC-4 cleanup use-after-free disclosed as CVE-2025-60482
Original title: CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup
The confirmed build is 2.5-DEV-rev1593-gfe88c3545-master; CISA ADP scores it 5.5 for local availability impact only.
Alexander A. Shvedov reported a heap use-after-free in GPAC MP4Box during AC-4 descriptor cleanup, tracked as CVE-2025-60482 (CWE-416). The affected revision is 2.5-DEV-rev1593-gfe88c3545-master, commit fe88c3545aadd597b250ccf23271d5d3de50ccc8. An upstream fix is commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b. The posted CISA ADP CVSS 3.1 score is 5.5 Medium, with local attack, user interaction, and high availability impact only.
Unconfirmed: The feed snippet ends before the full vulnerability description.
- Reporter is Alexander A. Shvedov (@sigdevel), posted October 29.
- CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
- The mailing-list description is truncated after the summary fields.
Impact: Local crash through a heap use-after-free
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1593-gfe88c3545-master | e02d1fd24cdc26acb1b236ab38b3832cffcae21b |
- 1.Update GPAC to upstream commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60482 | Heap use-after-free in GPAC MP4Box AC4 cleanup | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | e02d1fd24cdc26acb1b236ab38b3832cffcae21b | med) Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b (upstream commit) CVE: CVE-2025-60482 CWE: CWE-416 (Use Aft |
| sha1 | fe88c3545aadd597b250ccf23271d5d3de50ccc8 | ected: 2.5-DEV-rev1593-gfe88c3545-master (confirmed) Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b (upstream c |
From the original article
Posted by Alexander A. Shvedov on Oct 29 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1593-gfe88c3545-master (confirmed) Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b (upstream commit) CVE: CVE-2025-60482 CWE: CWE-416 (Use After Free) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.