GPAC MP4Box heap use-after-free via MPEG-2 TS (CVE-2025-60491)
Original title: CVE-2025-60491: heap use-after-free in GPAC/MP4Box dasher_flush_segment via crafted MPEG-2 TS input
The bug is in dasher_flush_segment() on 2.5-DEV-rev1698 and is fixed by commit f6128214.
Alexander A. Shvedov reported a heap use-after-free in GPAC's MP4Box, tracked as CVE-2025-60491 (CWE-416). A crafted MPEG-2 TS input reaches dasher_flush_segment(). The affected build is 2.5-DEV-rev1698-gfc2009fa7-master, and the stated fix is commit f6128214feb69cd689e4b9944a2621bc4ad8faf0. CVSS 3.1 is 8.8 High, with no user privileges but user interaction required.
- CVSS 3.1 is 8.8: network, low complexity, no privileges, user interaction.
- Impact ratings are high for confidentiality, integrity and availability.
- Affected commit is fc2009fa75631960743f8f7855dda8998167b5ab.
- The report was posted to oss-security on October 23.
Impact: Heap use-after-free from crafted MPEG-2 TS input
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1698-gfc2009fa7-master | f6128214feb69cd689e4b9944a2621bc4ad8faf0 |
- 1.Update MP4Box to commit f6128214feb69cd689e4b9944a2621bc4ad8faf0.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60491 | A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service… | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | f6128214feb69cd689e4b9944a2621bc4ad8faf0 | ster Commit fc2009fa75631960743f8f7855dda8998167b5ab Fixed: f6128214feb69cd689e4b9944a2621bc4ad8faf0 CVE: CVE-2025-60491 CWE: CWE-416 (Use After Free) CVSS 3.1: |
| sha1 | fc2009fa75631960743f8f7855dda8998167b5ab | (MP4Box) Affected: 2.5-DEV-rev1698-gfc2009fa7-master Commit fc2009fa75631960743f8f7855dda8998167b5ab Fixed: f6128214feb69cd689e4b9944a2621bc4ad8faf0 CVE: CVE-20 |
From the original article
Posted by Alexander A. Shvedov on Oct 23 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1698-gfc2009fa7-master Commit fc2009fa75631960743f8f7855dda8998167b5ab Fixed: f6128214feb69cd689e4b9944a2621bc4ad8faf0 CVE: CVE-2025-60491 CWE: CWE-416 (Use After Free) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.