Live › vulnerability › CVE-2025-60492
Go to dashboardMP4Box from GPAC before 2.5 has a stack overflow in its BIFS decoding function (gf_bifs_dec_node in /bifs/field_decode.c). A crafted MP4 file can crash the process, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run MP4Box from GPAC on untrusted MP4 files, such as media processing pipelines or upload converters, are exposed to a crash. Systems that only process trusted media, or that use a GPAC build at 2.5 or later, can skip it. Whether the crafted file needs BIFS scene content to reach the flawed code path is unknown.
No product ranges from the sources yet.
MP4Box -version and compare against 2.52.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60492")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.