{"id":"CVE-2025-60491","kind":"vulnerability","aliases":["CVE-2025-60491"],"related":[],"title":"GPAC MP4Box: crafted MP4 file triggers heap use-after-free crash","description":"A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","summary":"GPAC MP4Box, before version 2.5, has a heap use-after-free in the dasher_flush_segment function in filters/dasher.c. A crafted MP4 file can crash the tool, causing denial of service.","severity":"low","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package","self-hosted"],"not_affected_if":["no-mp4box-installed","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` to see the installed GPAC version.\n- Check whether MP4Box is used to process untrusted MP4 files, such as user uploads.","fix":"- Upgrade GPAC to `2.5` or later.\n- Until then, do not run MP4Box on untrusted MP4 files.","status":"open","published_at":"2026-10-21T15:17:13+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:08+00:00","updated_at":"2026-10-25T05:02:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:02:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC to `2.5` or later.\n- Until then, do not run MP4Box on untrusted MP4 files.","reach":"unknown","title":"GPAC MP4Box: crafted MP4 file triggers heap use-after-free crash","impact":"low","summary":"GPAC MP4Box, before version 2.5, has a heap use-after-free in the dasher_flush_segment function in filters/dasher.c. A crafted MP4 file can crash the tool, causing denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker crashes MP4Box with a crafted MP4 file, causing denial of service","analyst_note":"","how_to_check":"- Run `MP4Box -version` to see the installed GPAC version.\n- Check whether MP4Box is used to process untrusted MP4 files, such as user uploads.","needs_analyst":false,"not_affected_if":["trusted-input-only","no-mp4box-installed"],"who_is_affected":"Teams that run GPAC MP4Box, especially with DASH segmentation, on MP4 files they did not create, such as user uploads or files from external sources. Systems that only process trusted local media can skip it. The sources do not say which exact configurations reach dasher_flush_segment.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000594,"input_tokens":3346,"output_tokens":518,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':14A,17A '-60491':15A,18A '/filters/dasher.c':72C '2.5':32B,77C 'allow':78C 'attack':79C 'caus':56B,81C 'craft':3A,49B,90C 'crash':12A,53B 'cve':13A,16A 'dasher':42B,68C 'denial':57B,83C 'dos':86C 'file':5A,51B,92C 'filters/dasher.c':47B 'flush':43B,69C 'free':11A,39B,65C 'function':45B,71C 'gpac':1A,19B,28B,74C 'heap':7A,35B,61C 'host':27B 'media':21B 'media-process':20B 'mp4':4A,50B,91C 'mp4box':2A,23B,29B 'packag':24B 'process':22B 'project/mp4box':75C 'segment':44B,70C 'self':26B 'self-host':25B 'servic':59B,85C 'suppli':88C 'tool':55B 'trigger':6A 'use':9A,37B,63C 'use-after-fre':8A,36B,62C 'version':31B 'via':87C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC MP4Box, especially with DASH segmentation, on MP4 files they did not create, such as user uploads or files from external sources. Systems that only process trusted local media can skip it. The sources do not say which exact configurations reach dasher_flush_segment.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60491","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60491","severity":null,"published_at":"2026-10-21T15:17:13+00:00","modified_at":"2026-10-23T15:17:21+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2025-60491","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-60491","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}