Live › vulnerability › CVE-2025-60480
Go to dashboardMP4Box, the command-line tool in the GPAC multimedia framework, has a heap buffer overflow in the AC4 descriptor parser (gf_odf_ac4_cfg_alternative_info in odf/descriptors.c). A crafted AC4 file can crash the process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC's MP4Box on media files they did not create, such as user uploads or files pulled from external sources. The flaw is in AC4 audio descriptor parsing, so systems that never handle AC4 content are less exposed. Teams that only process their own encoded media can skip it.
No product ranges from the sources yet.
MP4Box -version and compare against the fixed release unknown2.5-DEV-rev1593-gfe88c3545-master (the fixed version is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60480")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.