What is the CVSS score of CVE-2025-60467?

CVE-2025-60467 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of GPAC MP4Box are affected by CVE-2025-60467?

The GPAC media processing software used by video encoding, transcoding, and content delivery systems can be remotely crashed via malicious media files, disrupting content processing workflows.

Is there a public PoC exploit available for CVE-2025-60467?

Yes, a public proof-of-concept exploit is available for CVE-2025-60467. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-60467?

Within 24 hours: Identify all systems using GPAC/libgpac and assess their role in critical workflows. Within 7 days: Update to GPAC version 26.02.0 or later, prioritizing systems that process external or untrusted media. Within 30 days: Complete testing of updated systems to verify media processing operations and document any systems unable to upgrade.

GPAC MP4Box CVE-2025-60467

EUVD-2025-210331 HIGH

Use After Free (CWE-416)

2026-06-24 mitre

GHSA-3q4w-vhww-wccf

Denial Of Service Use After Free Memory Corruption N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

MP4Box is a local file-parsing tool requiring a victim to process the crafted file, so AV:L and UI:R; impact is a crash only, giving A:H with C:N/I:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 25, 2026 - 14:34 vuln.today

Analysis Generated

Jun 25, 2026 - 14:34 vuln.today

CVSS changed

Jun 25, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

Jun 24, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

AnalysisAI

Denial of service in GPAC (libgpac/MP4Box) before 26.02.0 lets an attacker crash the application by feeding it a crafted media file that triggers a use-after-free in gf_filter_pid_inst_swap_delete_task within the filter-core PID handling code. Any pipeline or user that parses untrusted media through GPAC is affected, with publicly available proof-of-concept code, though no active exploitation has been reported and EPSS exploitation probability is low (0.17%, 6th percentile). Impact is limited to availability - there is no confidentiality or integrity loss per the CVSS vector.

Technical ContextAI

GPAC is a widely used open-source multimedia framework whose MP4Box tool and libgpac library handle muxing, demuxing and transcoding of MP4/ISOBMFF and many other container formats through an internal filter graph. The flaw is a CWE-416 Use-After-Free in src/filter_core/filter_pid.c: during PID (packet identifier) reconfiguration, gf_filter_pid_inst_swap_delete_task can operate on a filter PID instance whose memory has already been freed when a relink/detach is concurrently pending. The upstream fix (commit 976dacf65cb6986a4e4f350fb8d3ed0a17dc3a77) adds a guard so a destination is not relinked when a detach (pidinst->detach_pending) is already pending, preventing the freed instance from being reused. The CPE in the feed is a placeholder (cpe:2.3:a:n/a:n/a:*) and provides no usable product/version data, so affected-product identification rests on the GPAC issue/commit and the 'before 26.02.0' description.

RemediationAI

Upgrade GPAC/MP4Box to 26.02.0 or later, which includes the fix commit 976dacf65cb6986a4e4f350fb8d3ed0a17dc3a77 that guards against relinking a destination PID while a detach is pending (Vendor-released patch: 26.02.0; fix verifiable via the linked GPAC commit). If you cannot upgrade immediately, the practical compensating controls are to stop processing untrusted media with vulnerable builds: route untrusted/user-uploaded files through a different validated decoder, or sandbox/isolate MP4Box execution (run it as an unprivileged, resource-limited, restartable worker process) so a crash only kills the disposable worker rather than the host service - the trade-off is added pipeline complexity and latency. For server-side ingestion, restrict or queue file submission and add automatic restart/supervision so the DoS does not cause sustained outage. Track the upstream issue at https://github.com/gpac/gpac/issues/3286 and confirm your distribution has rebuilt against 26.02.0.