{"id":"CVE-2025-60476","kind":"vulnerability","aliases":["CVE-2025-60476"],"related":[],"title":"GPAC MP4Box: crafted AC4 file triggers use-after-free and crash","description":"A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","summary":"GPAC MP4Box versions before 2.5 contain a heap use-after-free in the gf_odf_ac4_cfg_clean_list function in odf/descriptors.c. An attacker who supplies a crafted AC4 file can crash the tool, causing a denial of service.","severity":"low","cvss":null,"epss":0.00176,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package"],"not_affected_if":["mp4box-not-installed","no-untrusted-media-input"],"how_to_check":"- Run `MP4Box -version` and compare the reported version against `2.5`.","fix":"- Upgrade GPAC MP4Box to `2.5` or later.","status":"open","published_at":"2026-10-21T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:05+00:00","updated_at":"2026-10-25T05:02:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:02:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC MP4Box to `2.5` or later.","reach":"unknown","title":"GPAC MP4Box: crafted AC4 file triggers use-after-free and crash","impact":"low","summary":"GPAC MP4Box versions before 2.5 contain a heap use-after-free in the gf_odf_ac4_cfg_clean_list function in odf/descriptors.c. An attacker who supplies a crafted AC4 file can crash the tool, causing a denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing"],"confidence":0.6,"needs_auth":"no","worst_case":"Tool crashes; denial of service on file processing","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare the reported version against `2.5`.","needs_analyst":false,"not_affected_if":["no-untrusted-media-input","mp4box-not-installed"],"who_is_affected":"Teams that run MP4Box, the GPAC command-line tool, on untrusted or user-supplied AC4 audio files, such as media ingest or conversion pipelines. Systems that only process trusted media files or do not use MP4Box can skip it. The sources do not say whether the library is also exposed through other GPAC components.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000578,"input_tokens":3362,"output_tokens":483,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':14A,17A '-60476':15A,18A '/odf/descriptors.c':80C '2.5':29B,85C 'ac4':4A,41B,54B,75C,99C 'allow':86C 'attack':49B,87C 'caus':60B,89C 'cfg':42B,76C 'clean':43B,77C 'contain':30B 'craft':3A,53B,98C 'crash':12A,57B 'cve':13A,16A 'denial':62B,91C 'dos':94C 'file':5A,55B,100C 'free':10A,36B,70C 'function':45B,79C 'gf':39B,73C 'gpac':1A,19B,25B,82C 'heap':32B,66C 'list':44B,78C 'media':21B 'media-process':20B 'mp4box':2A,23B,26B 'odf':40B,74C 'odf/descriptors.c':47B 'packag':24B 'process':22B 'project/mp4box':83C 'servic':64B,93C 'suppli':51B,96C 'tool':59B 'trigger':6A 'use':8A,34B,68C 'use-after-fre':7A,33B,67C 'version':27B 'via':95C","nicknames":[],"mitigations":[],"who_affected":"Teams that run MP4Box, the GPAC command-line tool, on untrusted or user-supplied AC4 audio files, such as media ingest or conversion pipelines. Systems that only process trusted media files or do not use MP4Box can skip it. The sources do not say whether the library is also exposed through other GPAC components.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60476","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60476","severity":null,"published_at":"2026-10-21T16:17:13+00:00","modified_at":"2026-10-22T21:17:13+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2025-60476","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-60476","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}