Live › vulnerability › CVE-2025-60487
Go to dashboardGPAC's MP4Box, before version 2.5, has a segmentation violation in the gf_isom_get_esd function when it processes a crafted XML file. An attacker who gets such a file to MP4Box can crash it, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC's MP4Box on servers or pipelines that accept XML files from outside sources, such as media conversion or ingestion services. Systems that only process trusted local media or do not have MP4Box installed can skip it. The sources do not describe which XML inputs trigger the crash beyond 'crafted XML'.
No product ranges from the sources yet.
MP4Box -version and compare the output to the fixed version (2.5 or later)which MP4Box)2.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60487")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.