GPAC MP4Box heap overflow via crafted AC-4 file (CVE-2025-60480)
Original title: CVE-2025-60480: Heap buffer overflow in GPAC/MP4Box gf_odf_ac4_cfg_alternative_info via crafted AC-4 file
The medium-severity out-of-bounds heap read is fixed in commit e02d1fd and rated CVSS 6.5.
Alexander A. Shvedov reported a heap-based buffer overflow in GPAC's MP4Box, CVE-2025-60480. A crafted AC-4 file causes an out-of-bounds heap read. It affects 2.5-DEV-rev1593-gfe88c3545-master at commit fe88c3545 and is fixed in e02d1fd24cdc26acb1b236ab38b3832cffcae21b. A BDU assessment rates it CVSS 3.1 6.5 medium, with high availability impact and no confidentiality or integrity impact.
Unconfirmed: The description is cut off, and the post does not say whether the flaw is exploited.
- The weakness is CWE-122, a heap-based buffer overflow.
- The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
- The affected commit is fe88c3545aadd597b250ccf23271d5d3de50ccc8.
- The report was posted to oss-security on October 20.
Impact: Out-of-bounds heap read that can crash MP4Box
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1593-gfe88c3545-master, commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 | e02d1fd24cdc26acb1b236ab38b3832cffcae21b |
- 1.Update GPAC MP4Box to commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60480 | A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows… | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | e02d1fd24cdc26acb1b236ab38b3832cffcae21b | ster Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-2025-60480 CWE: CWE-122 (Heap-based Buffer Overflo |
| sha1 | fe88c3545aadd597b250ccf23271d5d3de50ccc8 | (MP4Box) Affected: 2.5-DEV-rev1593-gfe88c3545-master Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-20 |
From the original article
Posted by Alexander A. Shvedov on Oct 20 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1593-gfe88c3545-master Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-2025-60480 CWE: CWE-122 (Heap-based Buffer Overflow) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.