Shvedov posts multiple unexploited GPAC MP4Box memory bugs
October 29: Shvedov posted CVE-2025-60482, a heap use-after-free in AC-4 descriptor cleanup on 2.5-DEV-rev1593, fixed by e02d1fd24cdc; CISA ADP scores it 5.5 for local availability impact only.
Alexander A. Shvedov has disclosed a series of GPAC MP4Box memory bugs; most have named fix commits and none are reported exploited.
From October 22 through October 29, Alexander A. Shvedov posted a series of GPAC MP4Box flaws to oss-security. Several are heap use-after-free bugs in stated 2.5-DEV builds, reached through crafted MPEG-2 TS or AC-4-related inputs; BDU scores cited for some are 8.8 or 7.8. Other issues are local crashes: uncontrolled BIFS recursion, NULL dereferences, and an AC-4 parser buffer over-read, generally scored 5.5 where a score is given. Named commits fix most issues. Notes on CVE-2025-60477, CVE-2025-60467, and CVE-2025-60475 give no fixed release, and no exploitation is stated.
- Reporter is Alexander A. Shvedov (@sigdevel) on oss-security.
- CVE-2025-60476 is a heap use-after-free fixed by commit e02d1fd24cdc; BDU CVSS 8.8.
- CVE-2025-60478 is fixed by c592a144bbe3; BDU CVSS 7.8, local access.
- CVE-2025-60490 and CVE-2025-60491 are MPEG-2 TS use-after-free bugs scored 8.8.
- CVE-2025-60492 and CVE-2025-60494 are local crashes scored CVSS 5.5.
- CVE-2025-60477, CVE-2025-60467, and CVE-2025-60475 name no fix or exploitation.
Timeline
dated events in the reporting · oldest first- Oct 22, 2026Shvedov posts CVE-2025-60476 and CVE-2025-60478. · oss-security
- Oct 23, 2026Posts cover CVE-2025-60490, 60491, 60492, and 60494. · oss-security
- Oct 25, 2026CVE-2025-60477 NULL dereference in DASH templates is posted. · oss-security
- Oct 26, 2026CVE-2025-60467 use-after-free on crafted MPEG-2 TS is posted. · oss-security
- Oct 27, 2026CVE-2025-60475 AC-4 parser buffer over-read is posted. · oss-security
- Oct 29, 2026CVE-2025-60482 AC-4 cleanup use-after-free is posted. · oss-security
What each outlet adds
beyond the shared facts- oss-securityNames affected 2.5-DEV revisions, fix commits, and BDU or CISA scores.
Coverage
oldest first · one row per article · UTC- · 8d ago
oss-securityFirst report
GPAC MP4Box AC-4 parser NULL dereference via crafted file (CVE-2025-60469)
BDU scores the availability-only crash CVSS 5.5; the fix is commit e02d1fd24cdc.
- · 8d ago
GPAC MP4Box AC-4 cleanup has heap use-after-free (CVE-2025-60476)
BDU scores it CVSS 8.8 with a network vector; the fix is commit e02d1fd24cdc.
- · 8d ago
GPAC MP4Box heap use-after-free in packet destruction (CVE-2025-60478)
The bug is in 2.5-DEV-rev1617 and scores CVSS 7.8 with local access and user interaction.
- · 8d ago
GPAC MP4Box NULL dereference via crafted BIFS (CVE-2025-60479)
A crafted BIFS scene can crash StatSFVec2f locally; CVSS 3.1 is 5.5 and a fix commit is named.
- · 8d ago
GPAC MP4Box divide-by-zero on truncated MP4 (CVE-2025-60496)
A local user opening a crafted file can crash MP4Box; CVSS 3.1 is 5.5 and a fix commit is named.
- · 8d ago
GPAC MP4Box out-of-bounds read on crafted AC-4 (CVE-2025-71438)
A stream-supplied frame_rate_index indexes fixed lookup tables; the snippet states no fix or affected build.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60467 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to… | 7.5 | <1% | PoC ×5 | |
| CVE-2025-60475 | Buffer overflow DoS in GPAC MP4Box before 2.5 | 5.5 | — | ||
| CVE-2025-60476 | A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of… | 5.5 | — | ||
| CVE-2025-60477 | A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows… | 5.0 | <1% | ||
| CVE-2025-60478 | A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of… | 5.5 | — | ||
| CVE-2025-60479 | A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of… | 5.5 | — | ||
| CVE-2025-60482 | Heap use-after-free in GPAC MP4Box AC4 cleanup | 5.5 | — | ||
| CVE-2025-60490 | A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to… | 5.5 | — | ||
| CVE-2025-60491 | A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service… | 5.5 | — | ||
| CVE-2025-60492 | A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS)… | 5.5 | — | ||
| CVE-2025-60494 | A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a… | 5.5 | — | ||
| CVE-2025-60496 | A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a… | 5.5 | — |