Live › vulnerability › CVE-2025-60482
Go to dashboardGPAC's MP4Box tool has a heap use-after-free in its AC4 descriptor cleanup code (gf_odf_ac4_cfg_clean_list in odf/descriptors.c). A crafted AC4 file can make MP4Box crash, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC's MP4Box on untrusted AC4 audio input, for example in media conversion or upload processing. Systems that only process their own media files, or do not use MP4Box, can skip it.
No product ranges from the sources yet.
MP4Box -version and compare against the development build named in the advisory: 2.5-DEV-rev1593-gfe88c3545-masterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60482")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.