GPAC MP4Box CVE-2025-60464
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious MPEG-2 TS file
-
DeliveryDeliver to victim or media pipeline
-
ExploitVictim runs MP4Box on file
-
ExecutionSEI loader frees AV1 state
-
PersistDangling pointer re-referenced on codec switch
-
ImpactProcess crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process an attacker-controlled, crafted MPEG-2 Transport Stream file with a vulnerable MP4Box/libgpac build (before 26.02.0) - the file must exercise the SEI loader's codec-type switch path that re-references the freed AV1 state. Per the CVSS vector this is local with required user interaction (AV:L/UI:R): the attacker cannot trigger it remotely or without the victim invoking MP4Box on the malicious file. Limiting factors are therefore significant - no network vector, no autonomous exploitation, and the target must actively parse the hostile TS file; documented impact is a crash (DoS) rather than confirmed code execution. |
| Impact | Signals point to a low-to-moderate real-world priority despite the 7.8 CVSS. The CVSS vector is local (AV:L) and requires user interaction (UI:R) - a victim must run MP4Box against an attacker-supplied file - which sharply limits mass exploitation; there is no remote, unauthenticated, or automatable path. EPSS is low (0.17%, 6th percentile) and the issue is absent from CISA KEV, indicating no observed active exploitation. Publicly available exploit code exists, but PoC availability is a distinct signal from active exploitation. There is also a notable conflict: the description and tags characterize the impact strictly as Denial of Service, yet the supplied CVSS vector claims full confidentiality and integrity loss (C:H/I:H/A:H) in addition to availability - this is inconsistent for a stated DoS-only use-after-free and should be verified, as the high C/I metrics appear over-rated relative to the documented crash-only impact. |
| Exploit ScenarioDerived | An attacker crafts a malicious MPEG-2 Transport Stream file and delivers it to a victim or an automated media-processing pipeline that uses MP4Box/libgpac. When the victim runs MP4Box against the file, the SEI loader re-uses a freed AV1 parser-state pointer and the process crashes, denying the service. A public PoC test case and README from researcher sigdevel demonstrate the crash, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_load_from_state_internal function of the SEI loader filter (src/filters/sei_load.c). Processing a maliciously crafted MPEG-2 Transport Stream file causes the parser to dereference a dangling pointer, crashing the application. Publicly available exploit code (a PoC test case and write-up) exists, though the issue is not listed in CISA KEV and carries a low EPSS exploitation probability (0.17%, 6th percentile).
RemediationAI
Upgrade to GPAC/MP4Box version 26.02.0 or later, which contains the corrected pointer-reset logic; the upstream fix is commit 8f404bd581e455267482f86272169a742f654b97 (referenced via issue https://github.com/gpac/gpac/issues/3278). Treat this as an upstream fix available via commit, with the 26.02.0 release line as the documented fixed version per the description. Where immediate upgrade is not possible, the practical compensating control is to avoid running MP4Box/libgpac against untrusted or attacker-supplied MPEG-2 TS files - process only files from trusted sources, and if MP4Box is used in an automated ingestion or transcoding pipeline, sandbox the process (e.g., run under a restricted user, seccomp, or a container with no sensitive mounts) so a crash cannot affect other workloads. The trade-off of restricting input is reduced automation/throughput for untrusted media; sandboxing adds operational overhead but contains the impact to a single process restart.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GPAC is a widely used open-source multimedia framework, and MP4Box is its command-line packaging/analysis utility. The flaw lives in the SEI (Supplemental Enhancement Information) loader filter, which manages per-codec parser state for AV1, VVC and other codecs. The root cause is CWE-416 (Use After Free): the commit diff (8f404bd) shows a copy-paste defect in seiloader_set_type() where, after freeing the AV1 state with gf_free(sei->av1_state), the code mistakenly nulled the unrelated pointer (sei->vvc_state = NULL) instead of sei->av1_state = NULL. This left sei->av1_state pointing at freed memory, so a subsequent codec-type switch triggered by a crafted MPEG-2 TS stream re-references the freed AV1 parser state. The official CPE string in the input is a placeholder (cpe:2.3:a:n/a:n/a:*), so exact affected-product enumeration relies on the description rather than NVD CPE data.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local parsing requiring the victim to open a crafted TS file gives AV:L/UI:R; documented impact is crash-only, so C:N/I:N/A:H rather than the input's high C/I.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file.
Executive ViewAI
GPAC's MP4Box multimedia processing tool (versions before 26.02.0) can crash when processing specially crafted media files, disrupting video processing workflows. Publicly available exploit code exists, and no patch is currently available, requiring immediate interim controls for organizations processing untrusted media content.
Restrict MP4Box to processing trusted sources only; disable SEI loader if unused; implement MPEG-2 TS file validation; apply application sandboxing to contain denial-of-service impact; establish continuous monitoring for GPAC patch announcements and plan immediate deployment of version 26.02.0 or later when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB