CVE-2025-60490

Awaiting Analysis Awaiting Analysis - Queue

Heap Use-After-Free in GPAC MP4Box

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: MITRE

Description

A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2025-60490

EUVD

EUVD-2025-211159

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

CVE-2025-60490 is a heap use-after-free vulnerability in the GPAC multimedia framework. It occurs in the gf_filter_pid_send_event_downstream function when processing a maliciously crafted MPEG-2 Transport Stream (TS) file. Due to earlier parsing errors, a Packet Identifier (PID) object is destroyed prematurely, but the function later attempts to access this freed memory, causing a use-after-free condition.

Detection Guidance

To detect this vulnerability, monitor GPAC's MP4Box tool for crashes or AddressSanitizer errors when processing MPEG-2 Transport Stream files. Use tools like AddressSanitizer during compilation to catch invalid memory access. Check for crashes with crafted TS files containing invalid sync markers or corrupted descriptors.

Impact Analysis

This vulnerability can lead to a Denial of Service (DoS) when an attacker supplies a specially crafted MP4 file. It may cause crashes or instability in applications using GPAC's MP4Box tool due to invalid memory access detected by tools like AddressSanitizer.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical DoS issue in a multimedia framework. Compliance impacts would only occur if the DoS disrupts systems handling regulated data, but no evidence suggests such a link.

Mitigation Strategies

Update GPAC to version 2.5 or later to apply the fix in commit d0793f9. Avoid processing untrusted MPEG-2 TS files with MP4Box. If updating is not possible, restrict access to MP4Box or implement input validation for TS files.

Hi! I’m here to help you understand CVE-2025-60490. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...