{"id":"CVE-2025-60475","kind":"vulnerability","aliases":["CVE-2025-60475"],"related":[],"title":"GPAC MP4Box: crafted media file overflows AC-4 parser, crashes it","description":"A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.","summary":"GPAC's MP4Box tool has a buffer overflow in its AC-4 audio parser (gf_ac4_parser_bs in media_tools/av_parsers.c) in versions before 2.5. A crafted input file can trigger it to cause a denial of service.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package","self-hosted"],"not_affected_if":["no-mp4box-install","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare against `2.5`\n- Check whether MP4Box runs on untrusted media files in your pipeline","fix":"- Upgrade GPAC/MP4Box to `2.5` or later\n- unknown for a specific patch commit or workaround","status":"open","published_at":"2026-10-20T22:17:42+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:16+00:00","updated_at":"2026-10-25T05:04:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:04:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC/MP4Box to `2.5` or later\n- unknown for a specific patch commit or workaround","reach":"unknown","title":"GPAC MP4Box: crafted media file overflows AC-4 parser, crashes it","impact":"low","summary":"GPAC's MP4Box tool has a buffer overflow in its AC-4 audio parser (gf_ac4_parser_bs in media_tools/av_parsers.c) in versions before 2.5. A crafted input file can trigger it to cause a denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker crashes MP4Box via a crafted file, denying service","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against `2.5`\n- Check whether MP4Box runs on untrusted media files in your pipeline","needs_analyst":false,"not_affected_if":["trusted-input-only","no-mp4box-install"],"who_is_affected":"Teams that run GPAC's MP4Box on media files they do not fully control, such as user uploads or transcoding services, are exposed. Sources do not say whether code execution is possible; only denial of service is described. Teams that only process trusted local files can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000585,"input_tokens":3314,"output_tokens":508,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':12A,15A '-4':8A,37B '-60475':13A,16A '/media_tools/av_parsers.c':74C '2.5':50B,79C 'ac':7A,36B 'ac4':41B,70C 'allow':80C 'attack':81C 'audio':38B 'bs':43B,72C 'buffer':32B,65C 'caus':59B,83C 'craft':3A,52B,92C 'crash':10A 'cve':11A,14A 'denial':61B,85C 'dos':88C 'file':5A,54B 'function':73C 'gf':40B,69C 'gpac':1A,17B,26B,76C 'host':25B 'input':53B,93C 'media':4A,19B,45B 'media-process':18B 'mp4box':2A,21B,28B 'overflow':6A,33B,66C 'packag':22B 'parser':9A,39B,42B,71C 'process':20B 'project/mp4box':77C 'self':24B 'self-host':23B 'servic':63B,87C 'suppli':90C 'tool':29B 'tools/av_parsers.c':46B 'trigger':56B 'version':48B 'via':89C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC's MP4Box on media files they do not fully control, such as user uploads or transcoding services, are exposed. Sources do not say whether code execution is possible; only denial of service is described. Teams that only process trusted local files can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60475","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60475","severity":null,"published_at":"2026-10-20T22:17:42+00:00","modified_at":"2026-10-22T17:16:02+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}