{"id":"CVE-2025-60493","kind":"vulnerability","aliases":["CVE-2025-60493"],"related":[],"title":"GPAC MP4Box: crafted MP4 file crashes the tool with a segmentation fault","description":"A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","summary":"A segmentation violation in the check_media_profile function of GPAC MP4Box before 2.5 can be triggered by a crafted MP4 file. An attacker who gets such a file processed can crash the tool, causing denial of service.","severity":"low","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package","self-hosted"],"not_affected_if":["gpac-2.5-or-later","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare against the fixed release.\n- Find any pipelines or services that run MP4Box on uploaded or untrusted MP4 files.","fix":"- Upgrade GPAC MP4Box to `2.5` or later.\n- Until upgraded, do not process untrusted MP4 files with MP4Box.","status":"open","published_at":"2026-10-21T15:17:14+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:08+00:00","updated_at":"2026-10-25T05:02:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:02:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC MP4Box to `2.5` or later.\n- Until upgraded, do not process untrusted MP4 files with MP4Box.","reach":"unknown","title":"GPAC MP4Box: crafted MP4 file crashes the tool with a segmentation fault","impact":"low","summary":"A segmentation violation in the check_media_profile function of GPAC MP4Box before 2.5 can be triggered by a crafted MP4 file. An attacker who gets such a file processed can crash the tool, causing denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"MP4Box crashes on a crafted file, causing denial of service","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against the fixed release.\n- Find any pipelines or services that run MP4Box on uploaded or untrusted MP4 files.","needs_analyst":false,"not_affected_if":["trusted-input-only","gpac-2.5-or-later"],"who_is_affected":"Teams that run GPAC MP4Box on MP4 files they did not create, such as media upload or transcoding services. Installations that only process trusted local files are at much lower risk. unknown whether other GPAC components are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000588,"input_tokens":3344,"output_tokens":507,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':14A,17A '-60493':15A,18A '/mp4box/mp4box.c':75C '2.5':41B,80C 'allow':81C 'attack':51B,82C 'caus':62B,84C 'check':33B,71C 'craft':3A,47B,93C 'crash':6A,59B 'cve':13A,16A 'denial':63B,86C 'dos':89C 'fault':12A 'file':5A,49B,56B,95C 'function':36B,74C 'get':53B 'gpac':1A,19B,38B,77C 'host':27B 'media':21B,34B,72C 'media-process':20B 'mp4':4A,48B,94C 'mp4box':2A,23B,39B 'packag':24B 'process':22B,57B 'profil':35B,73C 'project/mp4box':78C 'segment':11A,29B,67C 'self':26B 'self-host':25B 'servic':65B,88C 'suppli':91C 'tool':8A,61B 'trigger':44B 'via':90C 'violat':30B,68C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC MP4Box on MP4 files they did not create, such as media upload or transcoding services. Installations that only process trusted local files are at much lower risk. unknown whether other GPAC components are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60493","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60493","severity":null,"published_at":"2026-10-21T15:17:14+00:00","modified_at":"2026-10-22T17:16:02+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2025-60493","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-60493","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}