Live › vulnerability › CVE-2025-60490
Go to dashboardGPAC's MP4Box tool has a heap use-after-free in its filter event code, present before version 2.5. A crafted MP4 file can make it crash, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC's MP4Box on MP4 files, especially when those files come from users or outside sources, such as media conversion or upload processing. Systems that only handle trusted, locally created media are at much lower risk.
No product ranges from the sources yet.
MP4Box -version and compare against 2.52.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60490")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.