GPAC MP4Box stack exhaustion in BIFS decoder (CVE-2025-60492)
Original title: CVE-2025-60492: uncontrolled recursion in GPAC/MP4Box BIFS decoder via crafted MP4 input
Crafted MP4 input can recurse until the process stack is exhausted; CVSS is 5.5 medium.
Alexander A. Shvedov reported CVE-2025-60492 in GPAC's MP4Box: uncontrolled recursion in the BIFS decoder can exhaust the process stack on a crafted MP4. It is CWE-674, scored CVSS 3.1 5.5 with a CISA assessment noted, requiring local access and user interaction and affecting availability only. The affected build is 2.5-DEV-rev1687-ge44a4e2b0-master, commit e44a4e2b0d193566619ada71599e70255699da94, fixed by 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4. The October 23 post's description is truncated.
Unconfirmed: The mailing-list snippet cuts off before the full decoding details.
- CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
- The score is labeled a CISA assessment in the post.
- The fixed commit is 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4.
- The reporter is Alexander A. Shvedov (@sigdevel).
Impact: local process-stack exhaustion and crash in MP4Box
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1687-ge44a4e2b0-master (commit e44a4e2b0d193566619ada71599e70255699da94) | 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4 |
- 1.Update GPAC/MP4Box to commit 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4 or later.
- CVEs
- CVE-2025-60492
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60492 | A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS)… | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4 | ster Commit e44a4e2b0d193566619ada71599e70255699da94 Fixed: 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4 CVE: CVE-2025-60492 CWE: CWE-674 (Uncontrolled Recursion) C |
| sha1 | e44a4e2b0d193566619ada71599e70255699da94 | (MP4Box) Affected: 2.5-DEV-rev1687-ge44a4e2b0-master Commit e44a4e2b0d193566619ada71599e70255699da94 Fixed: 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4 CVE: CVE-20 |
From the original article
Posted by Alexander A. Shvedov on Oct 23 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1687-ge44a4e2b0-master Commit e44a4e2b0d193566619ada71599e70255699da94 Fixed: 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4 CVE: CVE-2025-60492 CWE: CWE-674 (Uncontrolled Recursion) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.