{"id":"CVE-2025-60487","kind":"vulnerability","aliases":["CVE-2025-60487"],"related":[],"title":"GPAC MP4Box: crafted XML file crashes the tool with a segfault","description":"A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.","summary":"GPAC's MP4Box, before version 2.5, has a segmentation violation in the gf_isom_get_esd function when it processes a crafted XML file. An attacker who gets such a file to MP4Box can crash it, causing a denial of service.","severity":"low","cvss":null,"epss":0.00168,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package","self-hosted"],"not_affected_if":["no-mp4box-installed","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare the output to the fixed version (2.5 or later)\n- Check whether MP4Box is installed on any system that processes untrusted XML input (`which MP4Box`)","fix":"- Upgrade GPAC to `2.5` or later\n- Until upgraded, do not feed untrusted XML files to MP4Box","status":"open","published_at":"2026-10-21T15:17:13+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:11+00:00","updated_at":"2026-10-25T05:02:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:02:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC to `2.5` or later\n- Until upgraded, do not feed untrusted XML files to MP4Box","reach":"unknown","title":"GPAC MP4Box: crafted XML file crashes the tool with a segfault","impact":"low","summary":"GPAC's MP4Box, before version 2.5, has a segmentation violation in the gf_isom_get_esd function when it processes a crafted XML file. An attacker who gets such a file to MP4Box can crash it, causing a denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"MP4Box crashes, causing denial of service on the processing host","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare the output to the fixed version (2.5 or later)\n- Check whether MP4Box is installed on any system that processes untrusted XML input (`which MP4Box`)","needs_analyst":false,"not_affected_if":["no-mp4box-installed","trusted-input-only"],"who_is_affected":"Teams that run GPAC's MP4Box on servers or pipelines that accept XML files from outside sources, such as media conversion or ingestion services. Systems that only process trusted local media or do not have MP4Box installed can skip it. The sources do not describe which XML inputs trigger the crash beyond 'crafted XML'.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000608,"input_tokens":3350,"output_tokens":546,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':13A,16A '-60487':14A,17A '/isomedia/isom_read.c':78C '2.5':32B,83C 'allow':84C 'attack':52B,85C 'caus':63B,87C 'craft':3A,48B,96C 'crash':6A,61B 'cve':12A,15A 'denial':65B,89C 'dos':92C 'esd':42B,76C 'file':5A,50B,57B,98C 'function':43B,77C 'get':41B,54B,75C 'gf':39B,73C 'gpac':1A,18B,27B,80C 'host':26B 'isom':40B,74C 'media':20B 'media-process':19B 'mp4box':2A,22B,29B,59B 'packag':23B 'process':21B,46B 'project/mp4box':81C 'segfault':11A 'segment':35B,69C 'self':25B 'self-host':24B 'servic':67B,91C 'suppli':94C 'tool':8A 'version':31B 'via':93C 'violat':36B,70C 'xml':4A,49B,97C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC's MP4Box on servers or pipelines that accept XML files from outside sources, such as media conversion or ingestion services. Systems that only process trusted local media or do not have MP4Box installed can skip it. The sources do not describe which XML inputs trigger the crash beyond 'crafted XML'.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60487","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60487","severity":null,"published_at":"2026-10-21T15:17:13+00:00","modified_at":"2026-10-23T15:17:21+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2025-60487","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-60487","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}