CVE-2025-60476

Awaiting Analysis Awaiting Analysis - Queue

Heap Use-After-Free in GPAC MP4Box via AC4 File

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: MITRE

Description

A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2025-60476

EUVD

EUVD-2025-211166

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

CVE-2025-60476 is a heap use-after-free vulnerability in the GPAC Project's MP4Box software before version 2.5. It occurs in the gf_odf_ac4_cfg_clean_list function in the odf/descriptors.c file. The issue involves improper memory handling when processing malformed AC-4 audio files, leading to memory being accessed after it has been freed.

Detection Guidance

To detect this vulnerability, monitor for crashes or memory errors when processing AC-4 audio files with GPAC's MP4Box. Use AddressSanitizer (ASan) or Valgrind to detect heap use-after-free conditions during file processing. Example commands: ./MP4Box -info <malformed_file> with ASan enabled, or valgrind --tool=memcheck ./MP4Box -info <file>.

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing the MP4Box application when processing a specially crafted AC-4 file. In severe cases, it may allow arbitrary code execution, potentially compromising the system running the vulnerable software.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) via heap use-after-free in GPAC's AC4 file processing. It does not directly impact GDPR or HIPAA compliance unless the affected system is part of a regulated environment where DoS could disrupt data processing or availability.

Mitigation Strategies

Update GPAC/MP4Box to version 2.5 or later to address the heap use-after-free vulnerability in the AC-4 parser.
Avoid processing untrusted AC-4 audio files until the update is applied to prevent potential DoS or code execution.
Monitor for crashes or memory errors when handling AC-4 files, which may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2025-60476. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...