{"id":"CVE-2025-60497","kind":"vulnerability","aliases":["CVE-2025-60497"],"related":[],"title":"GPAC MP4Box: crafted MP4 file crashes the tool, causing denial of service","description":"A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","summary":"GPAC MP4Box before 2.5 has a segmentation violation in the GetESD function in isomedia/track.c. An attacker who supplies a crafted MP4 file can crash the process, causing a denial of service.","severity":"medium","cvss":5.5,"epss":0.00172,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package"],"not_affected_if":["gpac-2.5-or-later","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare against `2.5`\n- Check whether MP4Box processes untrusted MP4 files, such as user uploads or remote media (unknown beyond this)","fix":"- Upgrade GPAC to `2.5` or later (exact patched release beyond 2.5 unknown)","status":"open","published_at":"2026-10-21T15:17:14+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:10:47+00:00","updated_at":"2026-10-25T04:10:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:10:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC to `2.5` or later (exact patched release beyond 2.5 unknown)","reach":"unknown","title":"GPAC MP4Box: crafted MP4 file crashes the tool, causing denial of service","impact":"low","summary":"GPAC MP4Box before 2.5 has a segmentation violation in the GetESD function in isomedia/track.c. An attacker who supplies a crafted MP4 file can crash the process, causing a denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Process crashes; service becomes unavailable until restarted","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against `2.5`\n- Check whether MP4Box processes untrusted MP4 files, such as user uploads or remote media (unknown beyond this)","needs_analyst":false,"not_affected_if":["trusted-input-only","gpac-2.5-or-later"],"who_is_affected":"Teams that run MP4Box or link GPAC on media they did not create, such as user uploads or files fetched from outside sources, are exposed to the crash. Systems that only process trusted, internally produced MP4 files are at low risk. The sources do not describe a default configuration that changes exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000589,"input_tokens":3345,"output_tokens":509,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':14A,17A '-60497':15A,18A '/isomedia/track.c':63C '2.5':28B,68C 'allow':69C 'attack':40B,70C 'caus':9A,51B,72C 'craft':3A,44B,81C 'crash':6A,48B 'cve':13A,16A 'denial':10A,53B,74C 'dos':77C 'file':5A,46B,83C 'function':36B,62C 'getesd':35B,61C 'gpac':1A,19B,25B,65C 'isomedia/track.c':38B 'media':21B 'media-process':20B 'mp4':4A,45B,82C 'mp4box':2A,23B,26B 'packag':24B 'process':22B,50B 'project/mp4box':66C 'segment':31B,57C 'servic':12A,55B,76C 'suppli':42B,79C 'tool':8A 'via':78C 'violat':32B,58C","nicknames":[],"mitigations":[],"who_affected":"Teams that run MP4Box or link GPAC on media they did not create, such as user uploads or files fetched from outside sources, are exposed to the crash. Systems that only process trusted, internally produced MP4 files are at low risk. The sources do not describe a default configuration that changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60497","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60497","severity":null,"published_at":"2026-10-21T15:17:14+00:00","modified_at":"2026-10-23T15:17:22+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2025-60497","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-60497","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}