{"id":"CVE-2025-60482","kind":"vulnerability","aliases":["CVE-2025-60482"],"related":[],"title":"GPAC MP4Box: crafted AC4 file triggers heap use-after-free crash","description":"A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","summary":"GPAC's MP4Box tool has a heap use-after-free in its AC4 descriptor cleanup code (gf_odf_ac4_cfg_clean_list in odf/descriptors.c). A crafted AC4 file can make MP4Box crash, causing a denial of service.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package"],"not_affected_if":["mp4box-not-used","no-untrusted-input"],"how_to_check":"- Run `MP4Box -version` and compare against the development build named in the advisory: `2.5-DEV-rev1593-gfe88c3545-master`\n- Check whether MP4Box processes untrusted AC4 input in a pipeline, such as a media upload or transcoding service","fix":"- Update GPAC to a release that includes the upstream fix for this issue (fixed version unknown from the sources)\n- Until patched, do not feed untrusted AC4 files to MP4Box","status":"open","published_at":"2026-10-19T19:17:03+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T05:10:56+00:00","updated_at":"2026-10-25T05:10:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:10:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update GPAC to a release that includes the upstream fix for this issue (fixed version unknown from the sources)\n- Until patched, do not feed untrusted AC4 files to MP4Box","reach":"local","title":"GPAC MP4Box: crafted AC4 file triggers heap use-after-free crash","impact":"low","summary":"GPAC's MP4Box tool has a heap use-after-free in its AC4 descriptor cleanup code (gf_odf_ac4_cfg_clean_list in odf/descriptors.c). A crafted AC4 file can make MP4Box crash, causing a denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing"],"confidence":0.6,"needs_auth":"no","worst_case":"MP4Box crashes while processing a crafted AC4 file","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against the development build named in the advisory: `2.5-DEV-rev1593-gfe88c3545-master`\n- Check whether MP4Box processes untrusted AC4 input in a pipeline, such as a media upload or transcoding service","needs_analyst":false,"not_affected_if":["no-untrusted-input","mp4box-not-used"],"who_is_affected":"Teams that run GPAC's MP4Box on untrusted AC4 audio input, for example in media conversion or upload processing. Systems that only process their own media files, or do not use MP4Box, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00061,"input_tokens":3338,"output_tokens":553,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':14A,17A '-60482':15A,18A '/odf/descriptors.c':78C '2.5':82C 'ac4':4A,38B,44B,52B,73C,101C 'allow':88C 'attack':89C 'caus':58B,91C 'cfg':45B,74C 'clean':46B,75C 'cleanup':40B 'code':41B 'craft':3A,51B,100C 'crash':12A,57B 'cve':13A,16A 'denial':60B,93C 'descriptor':39B 'dev':84C 'dev-rev1593-gfe88c3545-master':83C 'dos':96C 'file':5A,53B,102C 'free':11A,35B,68C 'function':77C 'gf':42B,71C 'gfe88c3545':86C 'gpac':1A,19B,25B,80C 'heap':7A,31B,64C 'list':47B,76C 'make':55B 'master':87C 'media':21B 'media-process':20B 'mp4box':2A,23B,27B,56B 'odf':43B,72C 'odf/descriptors.c':49B 'packag':24B 'process':22B 'project/mp4box':81C 'rev1593':85C 'servic':62B,95C 'suppli':98C 'tool':28B 'trigger':6A 'use':9A,33B,66C 'use-after-fre':8A,32B,65C 'via':97C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC's MP4Box on untrusted AC4 audio input, for example in media conversion or upload processing. Systems that only process their own media files, or do not use MP4Box, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T19:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60482","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60482","severity":null,"published_at":"2026-10-19T19:17:03+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}