GPAC MP4Box use-after-free on crafted MPEG-2 TS (CVE-2025-60467)
Original title: CVE-2025-60467: GPAC/MP4Box: Use-After-Free in gf_filter_pid_inst_swap_delete_task on crafted MPEG-2 TS file
The flaw is in a scheduled delete task in GPAC’s filter session core, triggered by a crafted MPEG-2 TS file.
Alexander A. Shvedov reported CVE-2025-60467 in GPAC’s MP4Box on October 26. gf_filter_pid_inst_swap_delete_task() in the filter session core deletes a filter PID and can be reached with a crafted MPEG-2 TS file. The excerpt does not give affected versions, a fix, or exploitation status.
Unconfirmed: Affected versions, a fix, and whether the bug is exploited are not in the excerpt.
- The function cited is gf_filter_pid_inst_swap_delete_task().
- The location given is filter_core/filter_pid.c line 574.
- The described trigger is a crafted MPEG-2 TS file.
Impact: use-after-free when parsing a crafted MPEG-2 TS file
| Product | Affected |
|---|---|
| GPAC MP4Box | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60467 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to… | 7.5 | <1% | PoC ×5 |
From the original article
Posted by Alexander A. Shvedov on Oct 26 Product: GPAC (MP4Box) https://infosec. exchange/@sigdevel> Description: The gf_filter_pid_inst_swap_delete_task() function in GPAC's filter session core (filter_core/filter_pid.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.