Five GPAC MP4Box memory bugs posted on oss-security
First merged summary.
Shvedov disclosed five separate GPAC MP4Box memory flaws from October 24 to 29; fixes are named for only two.
Between October 24 and October 29, Alexander A. Shvedov reported five distinct memory-safety issues in GPAC’s MP4Box on oss-security. They are CVE-2025-60493, a near-NULL dereference in check_media_profile; CVE-2025-60477, a NULL dereference while resolving DASH output file-name templates; CVE-2025-60467, a use-after-free in a filter PID delete task reached with a crafted MPEG-2 TS file; CVE-2025-60475, a global buffer over-read in the AC-4 parser; and CVE-2025-60482, a heap use-after-free during AC-4 descriptor cleanup. Fix commits are named only for CVE-2025-60493 and CVE-2025-60482. A third-party score is 4.3 for the first, and CISA ADP scores the last 5.5; none of the notes state known exploitation.
- Posts ran October 24–29 and name five separate CVE identifiers.
- CVE-2025-60493 affects 2.5-DEV-rev1699; fix commit 9afeea23 is cited.
- CVE-2025-60482 affects 2.5-DEV-rev1593; fix commit e02d1fd2 is cited.
- CISA ADP scores CVE-2025-60482 at 5.5, local, availability only.
- No fixed release is named for CVE-2025-60477, CVE-2025-60467, or CVE-2025-60475.
- None of the notes report known exploitation.
Timeline
dated events in the reporting · oldest first- Oct 24, 2026CVE-2025-60493 NULL dereference posted · oss-security
- Oct 25, 2026CVE-2025-60477 NULL dereference posted · oss-security
- Oct 26, 2026CVE-2025-60467 use-after-free posted · oss-security
- Oct 27, 2026CVE-2025-60475 AC-4 over-read posted · oss-security
- Oct 29, 2026CVE-2025-60482 heap use-after-free posted · oss-security
What each outlet adds
beyond the shared facts- oss-securityFive Shvedov posts name distinct MP4Box bugs and two fixes.
Coverage
oldest first · one row per article · UTC- · 6d ago
oss-securityFirst report
MP4Box NULL dereference via crafted MP4 (CVE-2025-60493)
A third-party CVSS 3.1 score of 4.3 rates the user-triggered flaw as a low-availability denial of service.
- · 5d ago
GPAC MP4Box NULL dereference on crafted MP4 metadata (CVE-2025-60477)
The crash is in gf_filter_pid_resolve_file_template_ex while resolving DASH output file-name templates.
- · 4d ago
GPAC MP4Box use-after-free on crafted MPEG-2 TS (CVE-2025-60467)
The flaw is in a scheduled delete task in GPAC’s filter session core, triggered by a crafted MPEG-2 TS file.
- · 3d ago
GPAC MP4Box AC-4 parser over-reads a buffer (CVE-2025-60475)
gf_ac4_parser_bs indexes a rate table with a frame_rate_index taken from a crafted AC-4 stream.
- · 1d ago
GPAC MP4Box AC-4 cleanup use-after-free disclosed as CVE-2025-60482
The confirmed build is 2.5-DEV-rev1593-gfe88c3545-master; CISA ADP scores it 5.5 for local availability impact only.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60467 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to… | 7.5 | <1% | PoC ×5 | |
| CVE-2025-60475 | Buffer overflow DoS in GPAC MP4Box before 2.5 | 5.5 | — | ||
| CVE-2025-60477 | A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows… | 5.0 | <1% | ||
| CVE-2025-60482 | Heap use-after-free in GPAC MP4Box AC4 cleanup | 5.5 | — | ||
| CVE-2025-60493 | NULL pointer dereference DoS in GPAC MP4Box before 2.5 | 5.5 | — |