CVE-2025-60478

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in GPAC MP4Box via MPEG-2 File

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: MITRE

Description

A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2025-60478

EUVD

EUVD-2025-211158

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

CVE-2025-60478 is a use-after-free vulnerability in GPAC Project's MP4Box tool. It occurs in the gf_filter_packet_destroy function when processing maliciously crafted MPEG-2 files with invalid program tables or empty DASH segments. The code fails to properly manage memory lifetimes, freeing memory that is later accessed again, leading to memory corruption or crashes.

Detection Guidance

To detect this vulnerability, monitor MP4Box processes for crashes when processing MPEG-2 files. Use AddressSanitizer to detect heap-use-after-free errors during execution. Example command: ASAN_OPTIONS=detect_leaks=1 MP4Box -dash input.mp4. Check for errors like 'heap-use-after-free write' in logs.

Impact Analysis

This vulnerability could allow attackers to cause a Denial of Service (DoS) by crashing the MP4Box tool. In severe cases, it might enable arbitrary code execution if exploited successfully. Users processing untrusted MPEG-2 files with MP4Box, especially with the -dash option, are at risk.

Compliance Impact

This vulnerability is a use-after-free issue in GPAC's MP4Box tool that could lead to crashes or arbitrary code execution when processing maliciously crafted MPEG-2 files. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than memory safety vulnerabilities in media processing tools.

Mitigation Strategies

Update GPAC to version 2.5 or later to apply the fix. Avoid processing untrusted MPEG-2 files with MP4Box, especially with the -dash option. If updating is not possible, restrict access to MP4Box or use sandboxing to limit potential exploitation.

Hi! I’m here to help you understand CVE-2025-60478. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...