What is the CVSS score of CVE-2025-60465?

CVE-2025-60465 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2025-60465?

Yes, a public proof-of-concept exploit is available for CVE-2025-60465. Prioritise patching immediately. EPSS: 0.2%.

GPAC MP4Box CVE-2025-60465

MEDIUM

Use After Free (CWE-416)

2026-06-25 mitre

Memory Corruption Denial Of Service Use After Free N A

6.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

vuln.today AI

5.5 MEDIUM

File-triggered DoS requires no authentication and no special privileges; AV:L for local file processing, UI:R for opening the crafted file, A:H for process crash with no confirmed confidentiality or integrity impact per the description.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 26, 2026 - 14:23 vuln.today

Analysis Generated

Jun 26, 2026 - 14:23 vuln.today

CVSS changed

Jun 26, 2026 - 14:22 NVD

6.1 (MEDIUM)

CVE Published

Jun 25, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

AnalysisAI

Use-after-free in MP4Box's filter pipeline core (gf_filter_pid_inst_swap in filter_pid.c) allows local attackers to crash the application - and potentially achieve memory corruption beyond DoS - by supplying a crafted media file. Publicly available exploit code exists for this vulnerability, hosted on GitHub in a dedicated proof-of-concept repository. The EPSS score is low (0.17%, 6th percentile) with no CISA KEV listing, suggesting the public POC is research-grade rather than part of active exploitation campaigns, but the barrier to triggering a crash is low for any attacker with file delivery capability.

Technical ContextAI

GPAC is an open-source multimedia framework for MP4/ISOBMFF processing, and MP4Box is its primary command-line tool used extensively in media transcoding and research toolchains. The vulnerability is a CWE-416 (Use After Free) in the filter pipeline subsystem at src/filter_core/filter_pid.c within gf_filter_pid_inst_swap. The root cause is inadequate lifecycle management of GF_FilterPidInst objects during PID relinking: when reconfigure tasks are triggered before a relinking operation completes, a PID instance can be registered as a relink target for a destination while another operation concurrently holds a stale pointer to that same instance. The upstream fix (commit 55b351bd) adds a guard that returns early if src_pidinst already equals filter_dst->swap_pidinst_dst, preventing the double-processing path that frees the object prematurely. The NVD CPE entry (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) is a placeholder and provides no usable asset-inventory scoping; affected versions are determined from the GitHub issue and fix commit context.

RemediationAI

Upgrade GPAC/MP4Box to version 26.02.0 or later, which incorporates the guard introduced in commit 55b351bd078c950592544ab4c708a613c1725b9b (https://github.com/gpac/gpac/commit/55b351bd078c950592544ab4c708a613c1725b9b). The originating issue is tracked at https://github.com/gpac/gpac/issues/3283. Note that the '26.02.0' version boundary is stated in the CVE description and linked to the fix commit, but a tagged release at that exact version string has not been independently verified from a formal release page - confirm the specific release tag in the GPAC GitHub repository before deploying. For organizations that cannot patch immediately, restrict MP4Box usage to trusted, internally-generated media files and prevent untrusted or user-submitted files from being processed through automated pipelines. There is no documented configuration flag to disable the affected filter PID swap code path without disabling core media processing functionality, so isolation of the processing environment is the primary compensating control.