{"id":"CVE-2025-60478","kind":"vulnerability","aliases":["CVE-2025-60478"],"related":[],"title":"GPAC MP4Box: crafted MPEG-2 file crashes the tool via use-after-free","description":"A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.","summary":"GPAC's MP4Box, before version 2.5, has a use-after-free in its packet destruction code. A crafted MPEG-2 file can make it crash, causing a denial of service.","severity":"low","cvss":null,"epss":0.00168,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package","self-hosted"],"not_affected_if":["default-config","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and check whether it reports a version earlier than `2.5`.\n- Check whether MP4Box is installed on the host or inside a media processing pipeline with `which MP4Box`.","fix":"- Upgrade GPAC to `2.5` or later.\n- Until upgraded, reject or sandbox untrusted MPEG-2 input passed to MP4Box.","status":"open","published_at":"2026-10-21T15:17:13+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:11+00:00","updated_at":"2026-10-25T05:02:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:02:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC to `2.5` or later.\n- Until upgraded, reject or sandbox untrusted MPEG-2 input passed to MP4Box.","reach":"local","title":"GPAC MP4Box: crafted MPEG-2 file crashes the tool via use-after-free","impact":"low","summary":"GPAC's MP4Box, before version 2.5, has a use-after-free in its packet destruction code. A crafted MPEG-2 file can make it crash, causing a denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker crashes MP4Box processing via a crafted MPEG-2 file.","analyst_note":"","how_to_check":"- Run `MP4Box -version` and check whether it reports a version earlier than `2.5`.\n- Check whether MP4Box is installed on the host or inside a media processing pipeline with `which MP4Box`.","needs_analyst":false,"not_affected_if":["default-config","trusted-input-only"],"who_is_affected":"Teams that run GPAC's MP4Box on untrusted MPEG-2 files, such as media conversion services or upload pipelines that process user-supplied video. Systems that only process trusted local media are at much lower risk.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000589,"input_tokens":3355,"output_tokens":508,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2':5A,50B,93C '-2025':16A,19A '-60478':17A,20A '/filter_core/filter_pck.c':73C '2.5':35B,78C 'allow':79C 'attack':80C 'caus':56B,82C 'code':46B 'craft':3A,48B,91C 'crash':7A,55B 'cve':15A,18A 'denial':58B,84C 'destroy':71C 'destruct':45B 'dos':87C 'file':6A,51B,94C 'filter':69C 'free':14A,41B,65C 'function':72C 'gf':68C 'gpac':1A,21B,30B,75C 'host':29B 'make':53B 'media':23B 'media-process':22B 'mp4box':2A,25B,32B 'mpeg':4A,49B,92C 'packag':26B 'packet':44B,70C 'process':24B 'project/mp4box':76C 'self':28B 'self-host':27B 'servic':60B,86C 'suppli':89C 'tool':9A 'use':12A,39B,63C 'use-after-fre':11A,38B,62C 'version':34B 'via':10A,88C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC's MP4Box on untrusted MPEG-2 files, such as media conversion services or upload pipelines that process user-supplied video. Systems that only process trusted local media are at much lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60478","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60478","severity":null,"published_at":"2026-10-21T15:17:13+00:00","modified_at":"2026-10-22T21:17:13+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2025-60478","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-60478","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}