Eleven GPAC MP4Box bugs posted; two still lack named fixes
October 26: Shvedov posted CVE-2025-60467, a use-after-free in gf_filter_pid_inst_swap_delete_task via crafted MPEG-2 TS, with no version, fix, or exploitation status.
Eleven MP4Box bugs posted by Shvedov; nine have named fixes, two lack versions and patches.
Alexander A. Shvedov posted eleven GPAC MP4Box vulnerabilities to oss-security from October 20 through October 26, 2026. Crafted AC-4, MPEG-2 TS, BIFS, or MP4 input can trigger heap use-after-free, an out-of-bounds heap read, divide-by-zero, NULL-pointer issues, or uncontrolled recursion. BDU scores put CVE-2025-60476, CVE-2025-60490, and CVE-2025-60491 at CVSS 3.1 8.8, CVE-2025-60478 at 7.8, and CVE-2025-60480 at 6.5; remaining scored issues are 5.5, with CVE-2025-60492 citing a CISA assessment. Nine posts name fix commits on specific 2.5-DEV revisions. The October 25 and October 26 posts on CVE-2025-60477 and CVE-2025-60467 name no version, fix, or exploitation; none of the snippets report observed exploitation.
- CVE-2025-60467 is a use-after-free in gf_filter_pid_inst_swap_delete_task via MPEG-2 TS.
- BDU rates CVE-2025-60476, CVE-2025-60490, and CVE-2025-60491 at CVSS 3.1 8.8.
- Nine issues name fix commits on specific 2.5-DEV revisions.
- CVE-2025-60477 and CVE-2025-60467 give no affected version or fix.
- No snippet reports observed exploitation.
Timeline
dated events in the reporting · oldest first- Oct 20, 2026CVE-2025-60480 heap overflow posted · oss-security
- Oct 22, 2026Three more MP4Box flaws posted, including CVSS 8.8 · oss-security
- Oct 23, 2026Four additional MP4Box vulnerabilities posted · oss-security
- Oct 25, 2026CVE-2025-60477 NULL dereference posted without a fix · oss-security
- Oct 26, 2026CVE-2025-60467 use-after-free posted without a fix · oss-security
What each outlet adds
beyond the shared facts- oss-securityOctober 26 post adds CVE-2025-60467 without version, fix, or exploitation status
Coverage
oldest first · one row per article · UTC- · 10d ago
oss-securityFirst report
GPAC MP4Box 2.4 use-after-free via crafted NHML input (CVE-2025-55654)
Impact is availability only: a local, low-privilege use-after-free scored CVSS 5.5 and fixed at commit 0ccd2927.
- · 10d ago
GPAC MP4Box NULL dereference in dump_isom_saps (CVE-2025-55667)
A local crash in build 2.5-DEV-rev1672 is fixed in commit e6d01820 and rated CVSS 5.5.
- · 10d ago
GPAC MP4Box heap overflow via crafted AC-4 file (CVE-2025-60480)
The medium-severity out-of-bounds heap read is fixed in commit e02d1fd and rated CVSS 6.5.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-55654 | A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS)… | 5.5 | — | ||
| CVE-2025-60467 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to… | 7.5 | <1% | PoC ×5 | |
| CVE-2025-60476 | A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of… | 5.5 | — | ||
| CVE-2025-60477 | A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows… | 5.0 | <1% | ||
| CVE-2025-60478 | A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of… | 5.5 | — | ||
| CVE-2025-60479 | A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of… | 5.5 | — | ||
| CVE-2025-60480 | A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows… | 5.5 | — | ||
| CVE-2025-60490 | A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to… | 5.5 | — | ||
| CVE-2025-60491 | A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service… | 5.5 | — | ||
| CVE-2025-60492 | A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS)… | 5.5 | — | ||
| CVE-2025-60494 | A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a… | 5.5 | — | ||
| CVE-2025-60496 | A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a… | 5.5 | — |