CVE-2025-60465

Analyzed Analyzed - Analysis Complete

Use-After-Free in GPAC MP4Box

Publication date: 2026-06-25

Last updated on: 2026-06-30

Assigner: MITRE

Description

A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-06-30

Generated

2026-07-16

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2025-60465

Affected Vendors & Products

Vendor	Product	Version / Range
gpac	gpac	to 26.02.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the gf_filter_pid_inst_swap function within the GPAC Project's MP4Box software before version 26.02.0. It occurs in the /filter_core/filter_pid.c file. A use-after-free vulnerability means that the software continues to use memory after it has been freed, which can lead to unexpected behavior.

In this case, attackers can exploit this flaw by supplying a specially crafted media file to the software.

Impact Analysis

Exploiting this vulnerability allows attackers to cause a Denial of Service (DoS) condition. This means the software could crash or become unresponsive when processing a maliciously crafted media file, potentially disrupting services or applications relying on MP4Box.

Detection Guidance

This vulnerability can be detected by attempting to process a crafted media file that triggers the use-after-free condition in GPAC's MP4Box tool.

A specific command to trigger detection is: ./MP4Box -info 34_gf_filter_pid_inst_swap_filter_core_filter_pid_c_633

Running this command results in an AddressSanitizer error indicating a heap-use-after-free, which confirms the presence of the vulnerability.

Mitigation Strategies

To mitigate this vulnerability, update GPAC/MP4Box to a version that includes the fix for this issue.

The fix involves a code change that prevents redundant relinking operations and properly handles the graph state to avoid the use-after-free condition.

If an immediate update is not possible, avoid processing untrusted or crafted media files that could trigger this vulnerability.

Hi! I’m here to help you understand CVE-2025-60465. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70