Executive Summary

CVE-2025-60486 is a heap use-after-free vulnerability in the dasher_process function within the filters/dasher.c file of the GPAC Project's MP4Box software before version 26.02.0.

This vulnerability occurs when processing maliciously crafted MPEG-2 Transport Stream files that contain corrupted Program Map Table (PMT) descriptors and repeated sync marker violations. Specifically, the dasher module improperly manages memory for PID contexts: a PID context is freed in the dasher_configure_pid() function but its pointer is later accessed in dasher_process(), leading to a use-after-free condition.

This memory mismanagement can cause the program to access freed heap memory, which is a serious programming error that can lead to crashes or other unpredictable behavior.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the heap use-after-free vulnerability in GPAC Project/MP4Box before version 26.02.0, you should update to the latest version of GPAC where the issue has been addressed.

The vulnerability is caused by improper memory management in the dasher module when processing crafted MPEG-2 Transport Stream files. Applying the patch that fixes memory handling in filters/dasher.c and related files will prevent exploitation.

If immediate updating is not possible, avoid processing untrusted or malicious MPEG-2 files with MP4Box, especially those that might contain corrupted Program Map Table descriptors or repeated sync marker violations.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability described is a heap use-after-free in the GPAC Project/MP4Box that allows an attacker to cause a Denial of Service (DoS) by supplying a crafted MPEG-2 file.

There is no information provided in the available context or resources about how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by attackers supplying a crafted MPEG-2 file to the vulnerable MP4Box software.

The primary impact is a Denial of Service (DoS), where the application crashes or becomes unstable due to the heap use-after-free error.

Such a crash could disrupt media processing workflows or services relying on GPAC's MP4Box, potentially causing downtime or loss of availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by processing a crafted MPEG-2 Transport Stream (TS) file that triggers the heap use-after-free in the dasher_process function of GPAC's MP4Box.

A specific command to reproduce and detect the issue is:

• ./MP4Box -dash 100 53_dasher_process_filters_dasher_c_9445

This command processes the corrupted TS file and exposes the memory corruption issue related to the vulnerability.

Useful 0 Not Useful 0