{"id":"CVE-2025-60492","kind":"vulnerability","aliases":["CVE-2025-60492"],"related":[],"title":"GPAC MP4Box: crafted MP4 file crashes the tool via stack overflow","description":"A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","summary":"MP4Box from GPAC before 2.5 has a stack overflow in its BIFS decoding function (gf_bifs_dec_node in /bifs/field_decode.c). A crafted MP4 file can crash the process, causing a denial of service.","severity":"medium","cvss":5.5,"epss":0.00253,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package","self-hosted"],"not_affected_if":["gpac-2.5-or-later","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare against `2.5`\n- unknown","fix":"- Upgrade GPAC to `2.5` or later\n- unknown","status":"open","published_at":"2026-10-21T15:17:13+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:10:48+00:00","updated_at":"2026-10-25T04:10:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:10:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC to `2.5` or later\n- unknown","reach":"local","title":"GPAC MP4Box: crafted MP4 file crashes the tool via stack overflow","impact":"low","summary":"MP4Box from GPAC before 2.5 has a stack overflow in its BIFS decoding function (gf_bifs_dec_node in /bifs/field_decode.c). A crafted MP4 file can crash the process, causing a denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Crafted file crashes MP4Box, interrupting the conversion job","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against `2.5`\n- unknown","needs_analyst":false,"not_affected_if":["gpac-2.5-or-later","trusted-input-only"],"who_is_affected":"Teams that run MP4Box from GPAC on untrusted MP4 files, such as media processing pipelines or upload converters, are exposed to a crash. Systems that only process trusted media, or that use a GPAC build at 2.5 or later, can skip it. Whether the crafted file needs BIFS scene content to reach the flawed code path is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000585,"input_tokens":3361,"output_tokens":498,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':13A,16A '-60492':14A,17A '/bifs/field_decode.c':46B,70C '2.5':31B,75C 'allow':76C 'attack':77C 'bif':38B,42B,66C 'caus':55B,79C 'craft':3A,48B,88C 'crash':6A,52B 'cve':12A,15A 'dec':43B,67C 'decod':39B 'denial':57B,81C 'dos':84C 'file':5A,50B,90C 'function':40B,69C 'gf':41B,65C 'gpac':1A,18B,29B,72C 'host':26B 'media':20B 'media-process':19B 'mp4':4A,49B,89C 'mp4box':2A,22B,27B 'node':44B,68C 'overflow':11A,35B,62C 'packag':23B 'process':21B,54B 'project/mp4box':73C 'self':25B 'self-host':24B 'servic':59B,83C 'stack':10A,34B,61C 'suppli':86C 'tool':8A 'via':9A,85C","nicknames":[],"mitigations":[],"who_affected":"Teams that run MP4Box from GPAC on untrusted MP4 files, such as media processing pipelines or upload converters, are exposed to a crash. Systems that only process trusted media, or that use a GPAC build at 2.5 or later, can skip it. Whether the crafted file needs BIFS scene content to reach the flawed code path is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60492","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60492","severity":null,"published_at":"2026-10-21T15:17:13+00:00","modified_at":"2026-10-23T15:17:21+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2025-60492","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-60492","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}