{"id":"CVE-2025-60480","kind":"vulnerability","aliases":["CVE-2025-60480"],"related":[],"title":"GPAC MP4Box: heap overflow from a crafted AC4 file crashes the tool","description":"A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","summary":"MP4Box, the command-line tool in the GPAC multimedia framework, has a heap buffer overflow in the AC4 descriptor parser (gf_odf_ac4_cfg_alternative_info in odf/descriptors.c). A crafted AC4 file can crash the process, causing denial of service.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package"],"not_affected_if":["trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare against the fixed release unknown\n- Check whether the team processes untrusted AC4 or MP4 media files with MP4Box","fix":"- Upgrade GPAC to a release later than `2.5-DEV-rev1593-gfe88c3545-master` (the fixed version is unknown from the sources)\n- Until patched, only run MP4Box on trusted input","status":"open","published_at":"2026-10-19T18:16:58+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:12:46+00:00","updated_at":"2026-10-25T04:12:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:12:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC to a release later than `2.5-DEV-rev1593-gfe88c3545-master` (the fixed version is unknown from the sources)\n- Until patched, only run MP4Box on trusted input","reach":"local","title":"GPAC MP4Box: heap overflow from a crafted AC4 file crashes the tool","impact":"low","summary":"MP4Box, the command-line tool in the GPAC multimedia framework, has a heap buffer overflow in the AC4 descriptor parser (gf_odf_ac4_cfg_alternative_info in odf/descriptors.c). A crafted AC4 file can crash the process, causing denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing"],"confidence":0.6,"needs_auth":"no","worst_case":"Crafted file crashes MP4Box, denying service to the processing job","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against the fixed release unknown\n- Check whether the team processes untrusted AC4 or MP4 media files with MP4Box","needs_analyst":false,"not_affected_if":["trusted-input-only"],"who_is_affected":"Teams that run GPAC's MP4Box on media files they did not create, such as user uploads or files pulled from external sources. The flaw is in AC4 audio descriptor parsing, so systems that never handle AC4 content are less exposed. Teams that only process their own encoded media can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000613,"input_tokens":3350,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':14A,17A '-60480':15A,18A '/odf/descriptors.c':79C '2.5':83C 'ac4':8A,43B,48B,56B,74C,102C 'allow':89C 'altern':50B,76C 'attack':90C 'buffer':39B,68C 'caus':62B,92C 'cfg':49B,75C 'command':28B 'command-lin':27B 'craft':7A,55B,101C 'crash':10A,59B 'cve':13A,16A 'denial':63B,94C 'descriptor':44B 'dev':85C 'dev-rev1593-gfe88c3545-master':84C 'dos':97C 'file':9A,57B,103C 'framework':35B 'function':78C 'gf':46B,72C 'gfe88c3545':87C 'gpac':1A,19B,33B,81C 'heap':3A,38B,67C 'info':51B,77C 'line':29B 'master':88C 'media':21B 'media-process':20B 'mp4box':2A,23B,25B 'multimedia':34B 'odf':47B,73C 'odf/descriptors.c':53B 'overflow':4A,40B,69C 'packag':24B 'parser':45B 'process':22B,61B 'project/mp4box':82C 'rev1593':86C 'servic':65B,96C 'suppli':99C 'tool':12A,30B 'via':98C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC's MP4Box on media files they did not create, such as user uploads or files pulled from external sources. The flaw is in AC4 audio descriptor parsing, so systems that never handle AC4 content are less exposed. Teams that only process their own encoded media can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T18:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60480","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60480","severity":null,"published_at":"2026-10-19T18:16:58+00:00","modified_at":"2026-10-20T19:17:10+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}