GPAC MP4Box AC-4 parser over-reads a buffer (CVE-2025-60475)
Original title: CVE-2025-60475: GPAC/MP4Box: Global Buffer Overflow Read in gf_ac4_parser_bs on crafted AC-4 stream
gf_ac4_parser_bs indexes a rate table with a frame_rate_index taken from a crafted AC-4 stream.
Alexander A. Shvedov reported a global buffer over-read in GPAC’s MP4Box AC-4 parser. gf_ac4_parser_bs() in media_tools/av_parsers.c uses a frame_rate_index read from the input stream to access AC4_SAMPLE_DELTA_TABLE_48 without a proper check. The oss-security note is truncated and does not state a fixed release or known attacks.
Unconfirmed: The mailing-list snippet is cut off before any fix, affected range, or exploit status.
- The function is gf_ac4_parser_bs() at media_tools/av_parsers.c line 16140.
- The index comes from frame_rate_index in the crafted AC-4 stream.
- The report was posted to oss-security on October 27.
- No fixed version or exploitation status appears in the snippet.
Impact: Out-of-bounds read on a crafted AC-4 stream
| Product | Affected |
|---|---|
| GPAC MP4Box | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60475 | Buffer overflow DoS in GPAC MP4Box before 2.5 | 5.5 | — |
From the original article
Posted by Alexander A. Shvedov on Oct 27 Product: GPAC (MP4Box) https://infosec. exchange/@sigdevel> Description: The gf_ac4_parser_bs() function in GPAC's AC-4 parser (media_tools/av_parsers.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.