{"id":"CVE-2025-60494","kind":"vulnerability","aliases":["CVE-2025-60494"],"related":[],"title":"GPAC MP4Box: crafted file causes segmentation fault and denial of service","description":"A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.","summary":"GPAC's MP4Box tool crashes with a segmentation violation in gf_props_equal_internal when it processes a crafted data file. An attacker who supplies such a file can cause a denial of service.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package","self-hosted"],"not_affected_if":["gpac-2.5-or-later","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare against the fixed version below\n- Check whether MP4Box processes untrusted files in any batch job, converter or upload pipeline","fix":"- Upgrade GPAC to `2.5` or later, which fixes the flaw\n- Until upgraded, do not feed untrusted media files to MP4Box","status":"open","published_at":"2026-10-20T22:17:42+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:14+00:00","updated_at":"2026-10-25T05:04:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:04:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC to `2.5` or later, which fixes the flaw\n- Until upgraded, do not feed untrusted media files to MP4Box","reach":"unknown","title":"GPAC MP4Box: crafted file causes segmentation fault and denial of service","impact":"low","summary":"GPAC's MP4Box tool crashes with a segmentation violation in gf_props_equal_internal when it processes a crafted data file. An attacker who supplies such a file can cause a denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"MP4Box crashes, causing denial of service on the processing host","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against the fixed version below\n- Check whether MP4Box processes untrusted files in any batch job, converter or upload pipeline","needs_analyst":false,"not_affected_if":["trusted-input-only","gpac-2.5-or-later"],"who_is_affected":"Teams running GPAC MP4Box versions before 2.5 that parse files from untrusted sources, such as media conversion services or upload handlers. Systems that only process locally created, trusted media files are much less exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000575,"input_tokens":3296,"output_tokens":491,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':13A,16A '-60494':14A,17A '/filter_core/filter_props.c':71C '2.5':76C 'allow':77C 'attack':49B,78C 'caus':5A,56B,80C 'craft':3A,45B,89C 'crash':31B 'cve':12A,15A 'data':46B,90C 'denial':9A,58B,82C 'dos':85C 'equal':39B,68C 'fault':7A 'file':4A,47B,54B,91C 'function':70C 'gf':37B,66C 'gpac':1A,18B,27B,73C 'host':26B 'intern':40B,69C 'media':20B 'media-process':19B 'mp4box':2A,22B,29B 'packag':23B 'process':21B,43B 'project/mp4box':74C 'prop':38B,67C 'segment':6A,34B,62C 'self':25B 'self-host':24B 'servic':11A,60B,84C 'suppli':51B,87C 'tool':30B 'via':86C 'violat':35B,63C","nicknames":[],"mitigations":[],"who_affected":"Teams running GPAC MP4Box versions before 2.5 that parse files from untrusted sources, such as media conversion services or upload handlers. Systems that only process locally created, trusted media files are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60494","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60494","severity":null,"published_at":"2026-10-20T22:17:42+00:00","modified_at":"2026-10-23T15:17:22+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}