CVE-2025-60494
Awaiting Analysis Awaiting Analysis - Queue

Segmentation Violation in GPAC MP4Box

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: MITRE

Description
A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-28
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2025-60494
EUVD
EUVD-2025-211139

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a segmentation violation in the gf_props_equal_internal function of GPAC Project/MP4Box before version 2.5. It occurs when processing a crafted data file, leading to a Denial of Service (DoS) due to a crash.

Impact Analysis

If you use GPAC Project/MP4Box before version 2.5, an attacker could exploit this flaw by providing a specially crafted file, causing the application to crash and disrupting normal operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-60494. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...