{"id":"CVE-2025-60490","kind":"vulnerability","aliases":["CVE-2025-60490"],"related":[],"title":"GPAC MP4Box: heap use-after-free lets a crafted MP4 crash it","description":"A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","summary":"GPAC's MP4Box tool has a heap use-after-free in its filter event code, present before version 2.5. A crafted MP4 file can make it crash, causing denial of service.","severity":"medium","cvss":null,"epss":0.00168,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package"],"not_affected_if":["gpac-2.5-or-later","no-untrusted-mp4-input"],"how_to_check":"- Run `MP4Box -version` and compare against `2.5`\n- Check whether MP4Box processes untrusted MP4 files in a pipeline or service","fix":"- Upgrade GPAC/MP4Box to `2.5` or later\n- Until then, do not feed untrusted MP4 files to MP4Box","status":"open","published_at":"2026-10-21T15:17:13+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:10+00:00","updated_at":"2026-10-25T05:02:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:02:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC/MP4Box to `2.5` or later\n- Until then, do not feed untrusted MP4 files to MP4Box","reach":"unknown","title":"GPAC MP4Box: heap use-after-free lets a crafted MP4 crash it","impact":"low","summary":"GPAC's MP4Box tool has a heap use-after-free in its filter event code, present before version 2.5. A crafted MP4 file can make it crash, causing denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker crashes MP4Box by supplying a crafted MP4 file","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against `2.5`\n- Check whether MP4Box processes untrusted MP4 files in a pipeline or service","needs_analyst":false,"not_affected_if":["gpac-2.5-or-later","no-untrusted-mp4-input"],"who_is_affected":"Teams that run GPAC's MP4Box on MP4 files, especially when those files come from users or outside sources, such as media conversion or upload processing. Systems that only handle trusted, locally created media are at much lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000577,"input_tokens":3355,"output_tokens":483,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':14A,17A '-60490':15A,18A '/filter_core/filter_pid.c':72C '2.5':44B,77C 'allow':78C 'attack':79C 'caus':53B,81C 'code':40B 'craft':10A,46B,90C 'crash':12A,52B 'cve':13A,16A 'denial':54B,83C 'dos':86C 'downstream':70C 'event':39B,69C 'file':48B,92C 'filter':38B,66C 'free':7A,35B,62C 'function':71C 'gf':65C 'gpac':1A,19B,25B,74C 'heap':3A,31B,58C 'let':8A 'make':50B 'media':21B 'media-process':20B 'mp4':11A,47B,91C 'mp4box':2A,23B,27B 'packag':24B 'pid':67C 'present':41B 'process':22B 'project/mp4box':75C 'send':68C 'servic':56B,85C 'suppli':88C 'tool':28B 'use':5A,33B,60C 'use-after-fre':4A,32B,59C 'version':43B 'via':87C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC's MP4Box on MP4 files, especially when those files come from users or outside sources, such as media conversion or upload processing. Systems that only handle trusted, locally created media are at much lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60490","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60490","severity":null,"published_at":"2026-10-21T15:17:13+00:00","modified_at":"2026-10-23T15:17:21+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2025-60490","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-60490","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}