CVE-2025-60464

Analyzed Analyzed - Analysis Complete

Use-After-Free in GPAC MP4Box via MPEG-2 TS File

Publication date: 2026-06-25

Last updated on: 2026-06-30

Assigner: MITRE

Description

A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-06-30

Generated

2026-07-16

AI Q&A

2026-06-26

EPSS Evaluated

2026-07-14

NVD

CVE-2025-60464

Affected Vendors & Products

Vendor	Product	Version / Range
gpac	gpac	to 26.02.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Impact Analysis

This vulnerability can lead to a Denial of Service (DoS) condition by crashing the application when it processes a maliciously crafted MPEG-2 TS file. Additionally, due to memory corruption caused by the use-after-free, there is a potential risk of arbitrary code execution, which could allow an attacker to execute malicious code on the affected system.

Executive Summary

CVE-2025-60464 is a use-after-free vulnerability in the GPAC project's function gf_sei_load_from_state_internal located in the file filters/sei_load.c. This vulnerability occurs when processing specially crafted MPEG-2 Transport Stream (TS) files containing HEVC or VVC streams. The issue arises because the code improperly manages memory references, leading to an attempt to access a heap buffer after it has already been freed by the NALU demuxer. This can cause memory corruption and potentially allow arbitrary code execution.

Detection Guidance

The vulnerability can be detected by monitoring for memory corruption or use-after-free errors when processing MPEG-2 TS files with GPAC/MP4Box, especially those containing HEVC or VVC streams.

AddressSanitizer was used to detect the heap-use-after-free read operation in the vulnerable function gf_sei_load_from_state_internal().

While no specific detection commands are provided, you can run GPAC/MP4Box with AddressSanitizer enabled to identify use-after-free errors when processing suspicious MPEG-2 TS files.

Mitigation Strategies

To mitigate this vulnerability, update GPAC/MP4Box to a version that includes the fix committed in commit 8f404bd581e455267482f86272169a742f654b97.

The fix corrects improper memory management in the SEI loader module, preventing the use-after-free condition.

Until an updated version is applied, avoid processing untrusted or crafted MPEG-2 TS files that may trigger the vulnerability.

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2025-60464. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70