Heap Buffer Overflow in GPAC MP4Box via AC4 File

Executive Summary

CVE-2025-60480 is a heap buffer overflow in GPAC Project/MP4Box affecting the gf_odf_ac4_cfg_alternative_info function. It occurs when processing maliciously crafted AC-4 audio files, causing an out-of-bounds memory read due to insufficient bounds checking of the alt_group_id array indices. This leads to a crash when the function attempts to read beyond the allocated buffer.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your GPAC version is 2.5-DEV-rev1593-gfe88c3545-master or earlier. Run MP4Box with a crafted AC-4 file to trigger the crash. Use AddressSanitizer during compilation to identify heap buffer overflows.

• Command to test: ./MP4Box -info 44_gf_odf_ac4_cfg_alternative_info_odf_descriptors_c_1899

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing the application when processing a specially crafted AC-4 file. If exploited, it may lead to application termination or potential arbitrary code execution depending on the system configuration and memory layout.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a technical flaw in GPAC's AC-4 audio parser that could cause crashes via crafted files. Compliance impacts would only occur if exploitation disrupted systems handling protected data, but no evidence suggests this vulnerability enables data breaches or unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

Update GPAC to the latest patched version, specifically commit e02d1fd or later. Avoid processing untrusted AC-4 files until patched. Monitor for crashes in MP4Box when handling AC-4 streams.

Useful 0 Not Useful 0