Live › vulnerability › CVE-2025-60478
Go to dashboardGPAC's MP4Box, before version 2.5, has a use-after-free in its packet destruction code. A crafted MPEG-2 file can make it crash, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC's MP4Box on untrusted MPEG-2 files, such as media conversion services or upload pipelines that process user-supplied video. Systems that only process trusted local media are at much lower risk.
No product ranges from the sources yet.
MP4Box -version and check whether it reports a version earlier than 2.5.which MP4Box.2.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60478")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.