CVE-2025-60491

Awaiting Analysis Awaiting Analysis - Queue

Heap Use-After-Free in GPAC MP4Box

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: MITRE

Description

A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2025-60491

EUVD

EUVD-2025-211164

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

CVE-2025-60491 is a heap use-after-free vulnerability in GPAC Project's MP4Box tool. It occurs in the dasher_flush_segment function in filters/dasher.c when processing crafted MPEG-TS input. The flaw allows memory to be accessed after it has been freed, potentially causing program crashes or arbitrary code execution.

Detection Guidance

To detect this vulnerability, monitor for crashes in GPAC's MP4Box tool when processing MPEG-TS files with the -dash command. Check for heap-use-after-free errors in logs or core dumps. Ensure your GPAC version is updated beyond the fix commit f612821.

Impact Analysis

This vulnerability could allow attackers to crash MP4Box or execute arbitrary code by supplying a specially crafted MP4 file. Users processing untrusted media files with MP4Box's -dash command are at risk of denial-of-service or potential code execution attacks.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a technical flaw in the GPAC project's DASH/HLS segmenter filter that could lead to program crashes or arbitrary code execution when processing crafted MPEG-TS input files. Compliance impacts would depend on how the affected software is used in a system handling regulated data.

Mitigation Strategies

Immediately update GPAC to a version that includes commit f612821 or later. Avoid processing untrusted MPEG-TS files with MP4Box's -dash command until patched. Monitor for crashes or memory corruption in affected systems.

Hi! I’m here to help you understand CVE-2025-60491. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...