Impact Analysis

This vulnerability can lead to a Denial of Service (DoS) condition by crashing the application when it processes a maliciously crafted MPEG-2 TS file. Additionally, due to memory corruption caused by the use-after-free, there is a potential risk of arbitrary code execution, which could allow an attacker to execute malicious code on the affected system.

Useful 0 Not Useful 0

Executive Summary

CVE-2025-60464 is a use-after-free vulnerability in the GPAC project's function gf_sei_load_from_state_internal located in the file filters/sei_load.c. This vulnerability occurs when processing specially crafted MPEG-2 Transport Stream (TS) files containing HEVC or VVC streams. The issue arises because the code improperly manages memory references, leading to an attempt to access a heap buffer after it has already been freed by the NALU demuxer. This can cause memory corruption and potentially allow arbitrary code execution.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability can be detected by monitoring for memory corruption or use-after-free errors when processing MPEG-2 TS files with GPAC/MP4Box, especially those containing HEVC or VVC streams.

AddressSanitizer was used to detect the heap-use-after-free read operation in the vulnerable function gf_sei_load_from_state_internal().

While no specific detection commands are provided, you can run GPAC/MP4Box with AddressSanitizer enabled to identify use-after-free errors when processing suspicious MPEG-2 TS files.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update GPAC/MP4Box to a version that includes the fix committed in commit 8f404bd581e455267482f86272169a742f654b97.

The fix corrects improper memory management in the SEI loader module, preventing the use-after-free condition.

Until an updated version is applied, avoid processing untrusted or crafted MPEG-2 TS files that may trigger the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0