Live › vulnerability › CVE-2025-60491
Go to dashboardGPAC MP4Box, before version 2.5, has a heap use-after-free in the dasher_flush_segment function in filters/dasher.c. A crafted MP4 file can crash the tool, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC MP4Box, especially with DASH segmentation, on MP4 files they did not create, such as user uploads or files from external sources. Systems that only process trusted local media can skip it. The sources do not say which exact configurations reach dasher_flush_segment.
No product ranges from the sources yet.
MP4Box -version to see the installed GPAC version.2.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60491")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.