Live › vulnerability › CVE-2025-60497
Go to dashboardGPAC MP4Box before 2.5 has a segmentation violation in the GetESD function in isomedia/track.c. An attacker who supplies a crafted MP4 file can crash the process, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run MP4Box or link GPAC on media they did not create, such as user uploads or files fetched from outside sources, are exposed to the crash. Systems that only process trusted, internally produced MP4 files are at low risk. The sources do not describe a default configuration that changes exposure.
No product ranges from the sources yet.
MP4Box -version and compare against 2.52.5 or later (exact patched release beyond 2.5 unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60497")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.