Live › vulnerability › CVE-2025-60475
Go to dashboardGPAC's MP4Box tool has a buffer overflow in its AC-4 audio parser (gf_ac4_parser_bs in media_tools/av_parsers.c) in versions before 2.5. A crafted input file can trigger it to cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC's MP4Box on media files they do not fully control, such as user uploads or transcoding services, are exposed. Sources do not say whether code execution is possible; only denial of service is described. Teams that only process trusted local files can skip it.
No product ranges from the sources yet.
MP4Box -version and compare against 2.52.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
This page as .md · .json · in your agent: get_signal("CVE-2025-60475")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.