Heap Use-After-Free in GPAC MP4Box via AC4 File

Executive Summary

CVE-2025-60482 is a heap use-after-free vulnerability in GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master. It occurs in the gf_odf_ac4_cfg_clean_list function when processing maliciously crafted AC-4 audio files. The issue involves a recursive cleanup function accessing memory that has already been freed, leading to crashes or segmentation faults.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or segmentation faults when processing AC-4 audio files with GPAC's MP4Box. Use AddressSanitizer or similar tools to identify heap-use-after-free errors during file processing. Test with the provided exploit file using the command ./MP4Box -add 46_gf_odf_ac4_cfg_clean_list_odf_descriptors_c_2411 -new /dev/null to trigger the issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause Denial of Service (DoS) by crashing applications that process AC-4 audio files. Attackers could exploit it by supplying a specially crafted file, triggering a read-after-free error and system instability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a heap use-after-free issue in GPAC Project/MP4Box that causes crashes via crafted AC4 files. It does not directly relate to data privacy or access controls required by GDPR or HIPAA. Compliance impact would depend on system usage but is not inherent to the vulnerability itself.

Useful 0 Not Useful 0

Mitigation Strategies

Update GPAC to the latest version that includes the fix from commit e02d1fd. Avoid processing untrusted AC-4 audio files until patched. Implement input validation for media files to prevent malformed streams from reaching the vulnerable parser.

Useful 0 Not Useful 0