Ten GPAC MP4Box memory bugs disclosed on oss-security
First merged summary.
Alexander A. Shvedov disclosed ten GPAC MP4Box memory bugs; several have named fix commits and none cite exploitation.
Alexander A. Shvedov posted a series of GPAC MP4Box vulnerabilities to oss-security from October 23 through October 29. The reports cover NULL-pointer dereferences, heap use-after-free, uncontrolled recursion, an invalid memory read, and a global buffer over-read, reached through crafted XML, MP4, MPEG-2 TS, or AC-4 input. The CVEs are CVE-2025-60487, CVE-2025-60489, CVE-2025-60490, CVE-2025-60491, CVE-2025-60492, CVE-2025-60494, CVE-2025-60477, CVE-2025-60467, CVE-2025-60475, and CVE-2025-60482. Several posts name affected 2.5-DEV revisions and fix commits; CVE-2025-60477, CVE-2025-60467, and CVE-2025-60475 give no fixed release. Cited scores range from CVSS 5.5 to 8.8, and no post states exploitation.
- Reporter is Alexander A. Shvedov (@sigdevel) on oss-security.
- CVE-2025-60490 and CVE-2025-60491 are scored CVSS 8.8 High.
- CVE-2025-60487 is CVSS 6.2; several others are scored 5.5.
- Fix commits are named for 60487, 60489, 60490, 60491, 60492, 60494, and 60482.
- CVE-2025-60477, 60467, and 60475 name no affected version or fix.
- No report states known exploitation.
Timeline
dated events in the reporting · oldest first- Oct 23, 2026Six MP4Box CVEs posted, including two scored 8.8. · oss-security
- Oct 25, 2026CVE-2025-60477 NULL dereference in DASH templates posted. · oss-security
- Oct 26, 2026CVE-2025-60467 use-after-free on crafted MPEG-2 TS posted. · oss-security
- Oct 27, 2026CVE-2025-60475 AC-4 parser global buffer over-read posted. · oss-security
- Oct 29, 2026CVE-2025-60482 AC-4 descriptor cleanup use-after-free posted. · oss-security
What each outlet adds
beyond the shared facts- oss-securityNamed fix commits, affected DEV revisions, and CVSS scores.
Coverage
oldest first · one row per article · UTC- · 7d ago
oss-securityFirst report
GPAC MP4Box NULL dereference via crafted XML (CVE-2025-60487)
gf_isom_get_esd() crashes on near-NULL; fixed in commit e6d01820, CVSS 6.2.
- · 7d ago
GPAC MP4Box NULL dereference via crafted MP4 (CVE-2025-60489)
dasher_insert_timeline_entry() can crash on near-NULL; the fix commit is 4860a1a6.
- · 7d ago
GPAC MP4Box use-after-free in filter event path (CVE-2025-60490)
Crafted MPEG-2 TS hits gf_filter_pid_send_event_downstream; the stated fix is commit d0793f92.
- · 7d ago
GPAC MP4Box heap use-after-free via MPEG-2 TS (CVE-2025-60491)
The bug is in dasher_flush_segment() on 2.5-DEV-rev1698 and is fixed by commit f6128214.
- · 7d ago
GPAC MP4Box stack exhaustion in BIFS decoder (CVE-2025-60492)
Crafted MP4 input can recurse until the process stack is exhausted; CVSS is 5.5 medium.
- · 7d ago
GPAC MP4Box invalid read via crafted MP4 (CVE-2025-60494)
A local NULL-pointer read can crash MP4Box; CVSS is 5.5 and a fix commit is named.
- · 7d ago
MP4Box GetESD NULL dereference via crafted MP4 (CVE-2025-60497)
GPAC 2.5-DEV commit 50b5741f2 crashes locally when a user opens a crafted MP4; the fix is commit 91083fcf.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60467 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to… | 7.5 | <1% | PoC ×5 | |
| CVE-2025-60475 | Buffer overflow DoS in GPAC MP4Box before 2.5 | 5.5 | — | ||
| CVE-2025-60477 | A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows… | 5.0 | <1% | ||
| CVE-2025-60482 | Heap use-after-free in GPAC MP4Box AC4 cleanup | 5.5 | — | ||
| CVE-2025-60487 | A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of… | 5.5 | — | ||
| CVE-2025-60489 | A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a… | 5.5 | — | ||
| CVE-2025-60490 | A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to… | 5.5 | — | ||
| CVE-2025-60491 | A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service… | 5.5 | — | ||
| CVE-2025-60492 | A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS)… | 5.5 | — | ||
| CVE-2025-60493 | NULL pointer dereference DoS in GPAC MP4Box before 2.5 | 5.5 | — | ||
| CVE-2025-60494 | A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a… | 5.5 | — | ||
| CVE-2025-60497 | A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via… | 5.5 | — |