Live › vulnerability › CVE-2025-60494
Go to dashboardGPAC's MP4Box tool crashes with a segmentation violation in gf_props_equal_internal when it processes a crafted data file. An attacker who supplies such a file can cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running GPAC MP4Box versions before 2.5 that parse files from untrusted sources, such as media conversion services or upload handlers. Systems that only process locally created, trusted media files are much less exposed.
No product ranges from the sources yet.
MP4Box -version and compare against the fixed version below2.5 or later, which fixes the flawEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60494")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.