GPAC MP4Box AC-4 cleanup has heap use-after-free (CVE-2025-60476)
Original title: CVE-2025-60476: Heap use-after-free in GPAC/MP4Box AC-4 descriptor cleanup
BDU scores it CVSS 8.8 with a network vector; the fix is commit e02d1fd24cdc.
Alexander A. Shvedov reported a heap use-after-free in gf_odf_ac4_cfg_clean_list() in GPAC's MP4Box. The affected build is 2.5-DEV-rev1593-gfe88c3545-master. It is fixed in commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b. BDU scored CVE-2025-60476 at CVSS 3.1 8.8 HIGH.
- CWE-416; vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
- Vulnerable commit is fe88c3545aadd597b250ccf23271d5d3de50ccc8.
- Posted on October 22 by Alexander A. Shvedov (@sigdevel).
- User interaction is required in the published CVSS vector.
Impact: Heap use-after-free during AC-4 descriptor cleanup
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1593-gfe88c3545-master | e02d1fd24cdc26acb1b236ab38b3832cffcae21b |
- 1.Update GPAC to commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60476 | A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of… | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | e02d1fd24cdc26acb1b236ab38b3832cffcae21b | ster Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-2025-60476 CWE: CWE-416 (Use After Free) CVSS 3.1: |
| sha1 | fe88c3545aadd597b250ccf23271d5d3de50ccc8 | (MP4Box) Affected: 2.5-DEV-rev1593-gfe88c3545-master Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-20 |
From the original article
Posted by Alexander A. Shvedov on Oct 22 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1593-gfe88c3545-master Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-2025-60476 CWE: CWE-416 (Use After Free) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.