CVE-2025-60467

Analyzed Analyzed - Analysis Complete

Use-After-Free in GPAC MP4Box Prior to 26.02.0

Publication date: 2026-06-24

Last updated on: 2026-06-29

Assigner: MITRE

Description

A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-29

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2025-60467

EUVD

EUVD-2025-210331

Affected Vendors & Products

Vendor	Product	Version / Range
gpac	gpac	to 26.02.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the function gf_filter_pid_inst_swap_delete_task within the GPAC Project's MP4Box software before version 26.02.0. It occurs when the software improperly handles memory, allowing attackers to exploit this flaw by supplying a specially crafted media file.

Impact Analysis

Exploiting this vulnerability can cause a Denial of Service (DoS) condition, meaning the affected software may crash or become unresponsive when processing a maliciously crafted media file.

Mitigation Strategies

To mitigate the use-after-free vulnerability in GPAC/MP4Box, avoid processing untrusted or crafted media files that could trigger the issue.

Monitor for updates or patches from the GPAC project addressing this specific vulnerability and apply them as soon as they become available.

If possible, run MP4Box in a restricted environment or sandbox to limit the impact of potential crashes or exploitation attempts.

Detection Guidance

This vulnerability can be detected by processing crafted media files that trigger the use-after-free condition in the GPAC MP4Box tool. Specifically, running MP4Box with the '-info' option on a specially crafted file can reveal the issue.

Use the command: ./MP4Box -info 37_gf_filter_pid_inst_swap_delete_task_filter_core_filter_pid_c_574

Monitoring for crashes or memory corruption during such operations, especially with AddressSanitizer logs, can help identify the presence of this vulnerability.

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2025-60467. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70