Live › vulnerability › CVE-2025-60476
Go to dashboardGPAC MP4Box versions before 2.5 contain a heap use-after-free in the gf_odf_ac4_cfg_clean_list function in odf/descriptors.c. An attacker who supplies a crafted AC4 file can crash the tool, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run MP4Box, the GPAC command-line tool, on untrusted or user-supplied AC4 audio files, such as media ingest or conversion pipelines. Systems that only process trusted media files or do not use MP4Box can skip it. The sources do not say whether the library is also exposed through other GPAC components.
No product ranges from the sources yet.
MP4Box -version and compare the reported version against 2.5.2.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60476")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.